CVE-2019-20358: trend micro trend micro anti-threat toolkit (attk) Untrusted Search Path
Vulnerability summary
CVE-2019-20358 is a high (CVSS 7.8) Untrusted Search Path vulnerability in trend micro trend micro anti-threat toolkit (attk). EPSS estimates a 4.62% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.
Timeline
- 30-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed. Another attack vector similar to CVE-2019-9491 was idenitfied and resolved in version 1.62.0.1228 of the tool.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.62%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.62% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
- CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Trend micro1 product
- trend micro anti-threat toolkit (attk)Version 1.62.0.1218 and below
Trendmicro1 product
- anti-threat_toolkit≤ 1.62.0.1218
2 vendors · 2 products