CVE-2021-36742

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 1,5%

Kerentanan Improper Input Validation pada trendmicro officescan, trendmicro officescan business security +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Rincian

Terbit di NVD

29 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Trend Micro Multiple Products Improper Input Validation Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

17 November 2021 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://success.trendmicro.com/jp/solution/000287796 advisory vendor
• https://success.trendmicro.com/jp/solution/000287815 advisory vendor
• https://success.trendmicro.com/solution/000287819 advisory vendor
• https://success.trendmicro.com/solution/000287820 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36742 pemerintah AS