Vulnerabilities > CVE-2020-8467 - Unspecified vulnerability in Trendmicro Apex ONE and Officescan
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Nessus
| NASL family | Windows |
| NASL id | TRENDMICRO_OFFICESCAN_000245571.NASL |
| description | According to its self-reported version, the Trend Micro OfficeScan application running on the remote host is prior to 12.0 CP 5474 (XG SP1) or 12.0 CP 1988 (XG). It is, therefore, affected by multiple vulnerabilities. - A remote code execution vulnerability exists due to a unsecured dll. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8598), (CVE-2020-8470) - A privilege escalation vulnerability exists due to a vulnerable EXE file. An unauthenticated, remote attacker can exploit this to gain root access to the system. (CVE-2020-8599) - A remote code execution vulnerability exists due to a migration tool component vulnerability. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8467) - A content validation escape vulnerability exist in the agent client components that could allow a authenticated remote attacker to manipulate OfficeScan components. (CVE-2020-8468) |
| last seen | 2020-03-26 |
| modified | 2020-03-18 |
| plugin id | 134629 |
| published | 2020-03-18 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/134629 |
| title | Trend Micro OfficeScan Multiple Vulnerabilities (000245571) |