Published: 20/01/2022 Updated: 27/01/2022

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an malicious user to escalate privileges and run arbitrary code in the context of root. Please note: an attacker must first obtain access to the target agent in an un-activated and unconfigured state in order to exploit this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trendmicro deep_security_agent 10.0
trendmicro deep_security_agent 11.0
trendmicro deep_security_agent 12.0
trendmicro deep_security_agent

Critical Vulnerabilities in Trend Micro Deep Security Agent for Linux

PoC Trend Micro Deep Security Agent (CVE-2022-23119, CVE-2022-23120) This repository contains proof of concept (PoC) bash scripts to perform the attacks described in MZ-21-02 PoC Arbitrary File Read / Directory Traversal Download Deep Security Agent 2000-2740 for Ubuntu_2004-x86_64 (20 LTS Update 2021-07-29) Verify SHA256 checksum: 183ea8a2240028aa9cfedd3f3733c9ff61aa108d8

CWE-94 https://success.trendmicro.com/solution/000290104 https://www.modzero.com/advisories/MZ-21-02-Trendmicro.txt https://nvd.nist.gov https://github.com/modzero/MZ-21-02-Trendmicro

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-23120

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect