CVE-2021-42103: Trend Micro Apex One Uncontrolled Search Path Element Privilege Escalation Vulnerability
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42103?
The severity of CVE-2021-42103 is considered high due to its potential for privilege escalation.
How do I fix CVE-2021-42103?
To fix CVE-2021-42103, update Trend Micro Apex One to the latest version as provided by Trend Micro.
What are the affected versions for CVE-2021-42103?
CVE-2021-42103 affects Trend Micro Apex One 2019 both on-premise and as a Service.
Can CVE-2021-42103 be exploited remotely?
CVE-2021-42103 requires local access for exploitation, as the attacker must execute low-privileged code.
Who is affected by CVE-2021-42103?
Organizations using Trend Micro Apex One 2019 are at risk of CVE-2021-42103.