cvelist/2022/36xxx/CVE-2022-36336.json

{
	"CVE_data_meta" : {
		"ASSIGNER" : "security@trendmicro.com",
		"ID" : "CVE-2022-36336",
		"STATE" : "PUBLIC"
	},
	"affects" : {
		"vendor" : {
			"vendor_data" : [
				{
					"product" : {
						"product_data" : [
							{
								"product_name" : "Trend Micro Apex One",
								"version" : {
									"version_data" : [
										{
											"version_value" : "2019 and SaaS"
										}
									]
								}
							},
							{
								"product_name" : "Trend Micro Worry-Free Business Security",
								"version" : {
									"version_data" : [
										{
											"version_value" : "10.0 SP1 and SaaS"
										}
									]
								}
							}
						]
					},
					"vendor_name" : "Trend Micro"
				}
			]
		}
	},
	"data_format" : "MITRE",
	"data_type" : "CVE",
	"data_version" : "4.0",
	"description" : {
		"description_data" : [
			{
				"lang" : "eng",
				"value" : "A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations.\r\n\r\nThe resolution for this issue has been deployed automatically via ActiveUpdate to customers in an updated Spyware pattern.  Customers who are up-to-date on detection patterns are not required to take any additional steps to mitigate this issue."
			}
		]
	},
	"problemtype" : {
		"problemtype_data" : [
			{
				"description" : [
					{
						"lang" : "eng",
						"value" : "Link Following LPE"
					}
				]
			}
		]
	},
	"references" : {
		"reference_data" : [
			{
				"url" : "https://success.trendmicro.com/solution/000291267"
			},
			{
				"url" : "https://www.zerodayinitiative.com/advisories/ZDI-22-1033/"
			}
		]
	}
}