Vulnerabilities > CVE-2020-8470 - Unspecified vulnerability in Trendmicro Apex One, Officescan and Worry-Free Business Security
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 7 |
Nessus
| NASL family | Windows |
| NASL id | TRENDMICRO_OFFICESCAN_000245571.NASL |
| description | According to its self-reported version, the Trend Micro OfficeScan application running on the remote host is prior to 12.0 CP 5474 (XG SP1) or 12.0 CP 1988 (XG). It is, therefore, affected by multiple vulnerabilities. - A remote code execution vulnerability exists due to a unsecured dll. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8598), (CVE-2020-8470) - A privilege escalation vulnerability exists due to a vulnerable EXE file. An unauthenticated, remote attacker can exploit this to gain root access to the system. (CVE-2020-8599) - A remote code execution vulnerability exists due to a migration tool component vulnerability. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8467) - A content validation escape vulnerability exist in the agent client components that could allow a authenticated remote attacker to manipulate OfficeScan components. (CVE-2020-8468) |
| last seen | 2020-03-26 |
| modified | 2020-03-18 |
| plugin id | 134629 |
| published | 2020-03-18 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/134629 |
| title | Trend Micro OfficeScan Multiple Vulnerabilities (000245571) |