CVE-2020-27015

Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

CVSS v3 4.4 MEDIUM
CVSS v2.0 2.1 LOW

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://helpcenter.trendmicro.com/en-us/article/TMKA-09975	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1286/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:trendmicro:antivirus:2020:*:*:*:*:macos:*:*

History

No history.

Information

Published : 2020-10-30 00:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-27015

Mitre link : CVE-2020-27015

CVE.ORG link : CVE-2020-27015

JSON object : View

Products Affected

trendmicro

antivirus

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2020-27015", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2020-10-30T00:15:12.263", "references": [{"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-09975", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1286/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability."}, {"lang": "es", "value": "Trend Micro Antivirus for Mac 2020 (Consumer) contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n de mensajes de error que, si se explota, podr\u00eda permitir que los punteros del n\u00facleo y los mensajes de depuraci\u00f3n se filtraran al terreno de los usuarios. Un atacante debe obtener primero la capacidad de ejecutar c\u00f3digo de alto privilegio en el sistema objetivo para poder explotar esta vulnerabilidad"}], "lastModified": "2020-11-05T16:15:26.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:antivirus:2020:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "A0D2AB9D-ECFC-4BA9-B440-6DC43AE46D7A"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}