An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product?s management console in order to exploit this vulnerability.

According to its self-reported version, the Trend Micro OfficeScan application running on the remote host is prior to 10 SP1 Patch 2329. It is, therefore, affected by multiple vulnerabilities:

 - An improper input validation vulnerability has been identified in business security. This may allow you to upload     arbitrary files remotely. An attacker would need to be able to log in to the product management console to exploit     this vulnerability. (CVE-2021-36741)

 - An improper input validation vulnerability has been identified in business security. This can lead to local     privilege escalation. Exploitation of this vulnerability requires low-privileged code execution on the target     system. (CVE-2021-36742)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Trend Micro WFBS  running on the remote Windows host is 10.0 SP1 prior to patch 2329. It is, therefore, affected by multiple vulnerabilities:
 
 - An improper input validation vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 allows    a remote attached to upload arbitrary files on affected installations. (CVE-2021-36741)

 - An improper input validation vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 allows    a local attacker to escalate privileges on affected installations. (CVE-2021-36742)

   Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported    version number.

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to patch 3 b9601. It is, therefore, affected by multiple vulnerabilities:

  - An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One and Apex     One as a Service could allow an attacker to modify a specific script before it is executed.     (CVE-2021-32464)  

  - An incorrect permission preservation vulnerability in Trend Micro Apex One and Apex One as a Service     could allow a remote user to perform an attack and bypass authentication on affected installations.     (CVE-2021-32465)

  - An improper input validation vulnerability in Trend Micro Apex One and Apex One as a Service allows a     remote attached to upload arbitrary files on affected installations. (CVE-2021-36741)

  - A improper input validation vulnerability in Trend Micro Apex One and Apex One as a Service allows a     local attacker to escalate privileges on affected installations. (CVE-2021-36742)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
154962	Trend Micro OfficeScan 10 SP1 < 10 SP1 Patch 2329 Multiple Vulnerabilities (000287815)	Nessus	Windows	high
154961	Trend Micro Worry-Free Business Security (WFBS) 10.0 SP1 < 10.0 SP1 Patch 2329 Multiple Vulnerabilities (000287820)	Nessus	Windows	high
154960	Trend Micro Apex One Multiple Vulnerabilities (000287819)	Nessus	Windows	high

Detections

Analytics

CVE-2021-36741

high

Tenable Plugins

high

high

high