Vulnerabilities > CVE-2020-8599 - Unspecified vulnerability in Trendmicro Apex ONE and Officescan
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Nessus
| NASL family | Windows |
| NASL id | TRENDMICRO_OFFICESCAN_000245571.NASL |
| description | According to its self-reported version, the Trend Micro OfficeScan application running on the remote host is prior to 12.0 CP 5474 (XG SP1) or 12.0 CP 1988 (XG). It is, therefore, affected by multiple vulnerabilities. - A remote code execution vulnerability exists due to a unsecured dll. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8598), (CVE-2020-8470) - A privilege escalation vulnerability exists due to a vulnerable EXE file. An unauthenticated, remote attacker can exploit this to gain root access to the system. (CVE-2020-8599) - A remote code execution vulnerability exists due to a migration tool component vulnerability. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. (CVE-2020-8467) - A content validation escape vulnerability exist in the agent client components that could allow a authenticated remote attacker to manipulate OfficeScan components. (CVE-2020-8468) |
| last seen | 2020-03-26 |
| modified | 2020-03-18 |
| plugin id | 134629 |
| published | 2020-03-18 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/134629 |
| title | Trend Micro OfficeScan Multiple Vulnerabilities (000245571) |