« Volver al listado

CVE-2022-26319

Estado: ModificadaMedia (6.5)—

An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily generated DLL file in an installer folder to elevate local privileges. Please note: an attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Trendmicro — Portable Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-26319",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro Portable Security",
          "versions": [
            {
              "status": "affected",
              "version": "3.0 (Pro), 3.0, 2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-08T22:15:07.827",
  "references": [
    {
      "url": "https://success.trendmicro.com/solution/000290531",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://success.trendmicro.com/solution/000290531",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily generated DLL file in an installer folder to elevate local privileges. Please note: an attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad del elemento de parche de búsqueda del instalador en Trend Micro Portable Security versiones 3.0 Pro, 3.0 y 2.0 podría permitir a un atacante local colocar un archivo DLL generado arbitrariamente en una carpeta del instalador para elevar los privilegios locales. Nota: un atacante debe obtener primero la capacidad de ejecutar código con privilegios elevados en el sistema de destino para poder explotar esta vulnerabilidad"
    }
  ],
  "lastModified": "2026-06-17T04:34:58.287",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:portable_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "193A9EE1-EC8A-47D4-8FF1-6DCEC49E1A21",
              "versionEndExcluding": "2.0.8056",
              "versionStartIncluding": "2.0"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:portable_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "854EFC18-5D2C-4737-B426-A95C13510AC7",
              "versionEndExcluding": "3.0.5054",
              "versionStartIncluding": "3.0"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:portable_security:*:*:*:*:pro:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A048FD9-0C82-4466-B583-2759BDA80CC3",
              "versionEndExcluding": "3.0.5054",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@trendmicro.com"
}