CVE-2022-26337: trend micro trend micro password manager Uncontrolled Search Path Element

Vulnerability summary

CVE-2022-26337 is a high (CVSS 9.3) Uncontrolled Search Path Element vulnerability in trend micro trend micro password manager. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities.

Timeline

1. 08-03-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could allow an attacker to use a specially crafted file to exploit the vulnerability and escalate local privileges on the affected machine.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.