Vulnerability Details : CVE-2019-14687
Potential exploit
A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14684.
Products affected by CVE-2019-14687
- cpe:2.3:a:trendmicro:password_manager:5.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-14687
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-14687
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-14687
-
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-14687
-
https://medium.com/@infiniti_css/fa839acaad59
Trend Micro Password Manager DLL Hijack - Infiniti Team - MediumExploit;Third Party Advisory
-
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123396.aspx
Vendor Advisory
Jump to