CVE-2022-30701: Trend Micro Apex One Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-30701?
CVE-2022-30701 is a vulnerability that allows local attackers to escalate privileges on affected installations of Trend Micro Apex One.
What is the severity of CVE-2022-30701?
The severity of CVE-2022-30701 is high, with a severity value of 7.8.
How can I exploit CVE-2022-30701?
To exploit CVE-2022-30701, an attacker must first obtain the ability to execute low-privileged code on the target system.
What is the affected software for CVE-2022-30701?
The affected software for CVE-2022-30701 includes Trend Micro Apex One versions up to 14.0.10349 and Trend Micro Trend Micro Apex One and Worry-Free Business Security 2019.
How do I fix CVE-2022-30701?
To fix CVE-2022-30701, it is recommended to update to the latest version of Trend Micro Apex One or Trend Micro Trend Micro Apex One and Worry-Free Business Security.