CVE-2022-30523
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be used for privilege escalation on the affected machine.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.40% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-59
- Affected
- trendmicro/password manager
- Source
- security@trendmicro.com
References
- https://helpcenter.trendmicro.com/en-us/article/tmka-09071Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-22-759/Third Party Advisory, VDB Entry
- https://helpcenter.trendmicro.com/en-us/article/tmka-09071Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-22-759/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.