CVE-2019-14684: trend micro trend micro password manager Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-14684 is a high (CVSS 9.3) Uncontrolled Search Path Element vulnerability in trend micro trend micro password manager. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-08-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14687.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.