CVE-2021-36744 : Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an

Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.

Published 2021-09-06 12:15:08

Updated 2022-07-12 17:42:04

Source Trend Micro, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2021-36744

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-36744

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-36744

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-36744

https://www.zerodayinitiative.com/advisories/ZDI-21-1052/

ZDI-21-1052 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://helpcenter.trendmicro.com/en-us/article/tmka-10568

Security Bulletin: Trend Micro Security (Consumer) Directory Junction Denial-of-Service Vulnerability “ | Trend Micro Help Center
Patch;Vendor Advisory

Products affected by CVE-2021-36744

Trendmicro » Maximum Security 2019 » Version: 15.0
cpe:2.3:a:trendmicro:maximum_security_2019:15.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Trendmicro » Maximum Security 2020 » Version: 16.0
cpe:2.3:a:trendmicro:maximum_security_2020:16.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Trendmicro » Maximum Security 2021 » Version: 17.0
cpe:2.3:a:trendmicro:maximum_security_2021:17.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Trendmicro » Maximum Security 2021 » Version: 17.2
cpe:2.3:a:trendmicro:maximum_security_2021:17.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Trendmicro » Security For Best Buy » Version: 2021
cpe:2.3:a:trendmicro:security_for_best_buy:2021:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

Vulnerability Details : CVE-2021-36744

Exploit prediction scoring system (EPSS) score for CVE-2021-36744

CVSS scores for CVE-2021-36744

CWE ids for CVE-2021-36744

References for CVE-2021-36744

Products affected by CVE-2021-36744