CVE-2021-44023: trend micro trend micro security (consumer) Link Following

Vulnerability summary

CVE-2021-44023 is a high (CVSS 7.1) Link Following vulnerability in trend micro trend micro security (consumer). EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities.

Timeline

1. 16-12-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.