CVE-2022-26319 — Uncontrolled Search Path Element in Portable Security

CWE-427 — Uncontrolled Search Path Element3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 81.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trendmicro Portable SecurityTrend Micro Portable Security
Timeline
PublishedMar 8
Latest updateMar 9

Description

An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily generated DLL file in an installer folder to elevate local privileges. Please note: an attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.6 | Impact: 5.9

Affected Packages2 packages

▶NVDtrendmicro/portable_security2.0 — 2.0.8056+1
▶CVEListV5trend_micro/trend_micro_portable_security3.0 (Pro), 3.0, 2.0

Patches

Patch: success.trendmicro.com ↗Patch: success.trendmicro.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8m48-f4hj-956j: An installer search patch element vulnerability in Trend Micro Portable Security 3↗2022-03-09
▶
CVEList
CVE-2022-26319: An installer search patch element vulnerability in Trend Micro Portable Security 3↗2022-03-08
▶
CVE-2022-26319 — Uncontrolled Search Path Element | cvebase