CVE-2019-9491: trend micro trend micro anti-threat toolkit (attk) Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-9491 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in trend micro trend micro anti-threat toolkit (attk). EPSS estimates a 12.94% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 6 public exploits are recorded.

Timeline

1. 21-10-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.