CVE-2020-27013: Trend Micro Antivirus for Mac Improper Access Control Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the iCoreService endpoint, which listens on local TCP port 37848 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information in the context of root.
Other sources
Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implements an API with several properties that can be read and written to allowing the attacker to gather and modify sensitive product and user data. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27013?
CVE-2020-27013 is a vulnerability that allows local attackers to disclose sensitive information on affected installations of Trend Micro Antivirus for Mac.
How does CVE-2020-27013 affect Trend Micro Antivirus for Mac?
CVE-2020-27013 affects Trend Micro Antivirus for Mac by allowing local attackers to disclose sensitive information.
What is the severity of CVE-2020-27013?
The severity of CVE-2020-27013 is medium, with a CVSS score of 4.4.
How can CVE-2020-27013 be exploited?
CVE-2020-27013 can be exploited by first obtaining the ability to execute low-privileged code on the target system.
How can I fix CVE-2020-27013 in Trend Micro Antivirus for Mac?
To fix CVE-2020-27013 in Trend Micro Antivirus for Mac, it is recommended to update to the latest version provided by the vendor.