Log in Start free

Actively exploited · Published Mar 18, 2020 · Assigned by trendmicro

CVE-2020-8468

High 8.8 Exploited

In plain English

A high-severity injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) from Trend Micro. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)6.2%top 6.5% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.

Affected products (as reported)

VendorProductVersions
Trend Micro Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) OfficeScan XG (12.0), Apex One 2019 (14.0), WFBS 9.0, 9.5 and 10.0

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References