Vulnerability · Published Sep 28, 2022 · Assigned by trendmicro

CVE-2022-40708

Low 3.3

In plain English

A low-severity out-of-bounds read in Trend Micro Deep Security from Trend Micro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707.

Affected products (as reported)

Vendor	Product	Versions
Trend Micro	Trend Micro Deep Security	20

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://success.trendmicro.com/solution/000291590 x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-22-1298/ x_refsource_MISC