CVE-2021-36741 - Vulnerability Details - OpenCVE

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows
Trendmicro	Apex One Officescan Officescan Business Security Worry-free Business Security

Configuration 1 [-]

OR	cpe:2.3:a:trendmicro:officescan:xg:sp1::::::
	cpe:2.3:a:trendmicro:officescan_business_security:10.0:sp1::::::

Configuration 2 [-]

AND

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

OR	cpe:2.3:a:trendmicro:apex_one:2019:::::::*
	cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1::::::

No data.

References

Link	Providers
https://success.trendmicro.com/jp/solution/000287796
https://success.trendmicro.com/jp/solution/000287815
https://success.trendmicro.com/solution/000287819
https://success.trendmicro.com/solution/000287820

History

Wed, 14 Aug 2024 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20	CWE-434

MITRE

Status: PUBLISHED

Assigner: trendmicro

Published: 2021-07-29T19:23:13.000Z

Updated: 2025-02-07T16:38:20.976Z

Reserved: 2021-07-14T00:00:00.000Z

Link: CVE-2021-36741

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-07-29T20:15:07.620

Modified: 2025-02-12T19:23:38.797

Link: CVE-2021-36741

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Trend Micro Apex One", "vendor": "Trend Micro", "versions": [{"status": "affected", "version": "2019, SaaS"}]}, {"product": "Trend Micro OfficeScan", "vendor": "Trend Micro", "versions": [{"status": "affected", "version": "XG SP1"}]}, {"product": "Trend Micro Worry-Free Business Security", "vendor": "Trend Micro", "versions": [{"status": "affected", "version": "10.0 SP1"}]}], "descriptions": [{"lang": "en", "value": "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product\ufffds management console in order to exploit this vulnerability."}], "problemTypes": [{"descriptions": [{"description": "Arbitrary File Upload", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-07-29T19:23:13.000Z", "orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://success.trendmicro.com/solution/000287819"}, {"tags": ["x_refsource_MISC"], "url": "https://success.trendmicro.com/solution/000287820"}, {"tags": ["x_refsource_MISC"], "url": "https://success.trendmicro.com/jp/solution/000287796"}, {"tags": ["x_refsource_MISC"], "url": "https://success.trendmicro.com/jp/solution/000287815"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@trendmicro.com", "ID": "CVE-2021-36741", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Trend Micro Apex One", "version": {"version_data": [{"version_value": "2019, SaaS"}]}}, {"product_name": "Trend Micro OfficeScan", "version": {"version_data": [{"version_value": "XG SP1"}]}}, {"product_name": "Trend Micro Worry-Free Business Security", "version": {"version_data": [{"version_value": "10.0 SP1"}]}}]}, "vendor_name": "Trend Micro"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product\ufffds management console in order to exploit this vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Arbitrary File Upload"}]}]}, "references": {"reference_data": [{"name": "https://success.trendmicro.com/solution/000287819", "refsource": "MISC", "url": "https://success.trendmicro.com/solution/000287819"}, {"name": "https://success.trendmicro.com/solution/000287820", "refsource": "MISC", "url": "https://success.trendmicro.com/solution/000287820"}, {"name": "https://success.trendmicro.com/jp/solution/000287796", "refsource": "MISC", "url": "https://success.trendmicro.com/jp/solution/000287796"}, {"name": "https://success.trendmicro.com/jp/solution/000287815", "refsource": "MISC", "url": "https://success.trendmicro.com/jp/solution/000287815"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:01:59.373Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://success.trendmicro.com/solution/000287819"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://success.trendmicro.com/solution/000287820"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://success.trendmicro.com/jp/solution/000287796"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://success.trendmicro.com/jp/solution/000287815"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-36741", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-06T19:40:34.627421Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2021-11-03", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36741"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T16:38:20.976Z"}}]}, "cveMetadata": {"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "assignerShortName": "trendmicro", "cveId": "CVE-2021-36741", "datePublished": "2021-07-29T19:23:13.000Z", "dateReserved": "2021-07-14T00:00:00.000Z", "dateUpdated": "2025-02-07T16:38:20.976Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"cisaActionDue": "2021-11-17", "cisaExploitAdd": "2021-11-03", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Trend Micro Multiple Products Improper Input Validation Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*", "matchCriteriaId": "64600B42-4884-41F2-A683-AE1EDB79372E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:officescan_business_security:10.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "762313F8-2BA6-4ED7-A977-56C962D5B27F", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*", "matchCriteriaId": "AF019D2D-C426-4D2D-A254-442CE777B41E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "FFCE8717-85D2-4F4F-91DF-C6DA341C4E19", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product?s management console in order to exploit this vulnerability."}, {"lang": "es", "value": " Una vulnerabilidad de validaci\u00f3n de entrada incorrecta en Trend Micro Apex One, Apex One as a Service, OfficeScan XG y Worry-Free Business Security 10.0 SP1 permite que un control remoto conectado cargue archivos arbitrarios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de iniciar sesi\u00f3n en la consola de administraci\u00f3n del producto para poder aprovechar esta vulnerabilidad."}], "id": "CVE-2021-36741", "lastModified": "2025-02-12T19:23:38.797", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2021-07-29T20:15:07.620", "references": [{"source": "security@trendmicro.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/jp/solution/000287796"}, {"source": "security@trendmicro.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/jp/solution/000287815"}, {"source": "security@trendmicro.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/000287819"}, {"source": "security@trendmicro.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/000287820"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/jp/solution/000287796"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/jp/solution/000287815"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/000287819"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/000287820"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}