CVE-2021-36741
Last modified
CVE-2021-36741 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.. CISA has confirmed active exploitation in the wild. EPSS estimates a 4.95% chance of exploitation in the next 30 days.
Description
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Trendmicro | Officescan | xg | Sp1 |
| Trendmicro | Officescan Business Security | 10.0 | Sp1 |
| Trendmicro | Apex One | 2019 | — |
| Trendmicro | Worry-Free Business Security | 10.0 | Sp1 |
References
- https://success.trendmicro.com/jp/solution/000287796Broken Link, Vendor Advisory
- https://success.trendmicro.com/jp/solution/000287815Broken Link, Vendor Advisory
- https://success.trendmicro.com/solution/000287819Broken Link, Vendor Advisory
- https://success.trendmicro.com/solution/000287820Broken Link, Vendor Advisory
- https://success.trendmicro.com/jp/solution/000287796Broken Link, Vendor Advisory
- https://success.trendmicro.com/jp/solution/000287815Broken Link, Vendor Advisory
- https://success.trendmicro.com/solution/000287819Broken Link, Vendor Advisory
- https://success.trendmicro.com/solution/000287820Broken Link, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36741US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-36741?
How severe is CVE-2021-36741?
How do I fix CVE-2021-36741?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-36736Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-36737The input fields of the Apache Pluto UrlTestPortlet are vuln…6.1
- CVE-2021-36738The input fields in the JSP version of the Apache Pluto Appl…6.1
- CVE-2021-36739The "first name" and "last name" fields of the Apache Pluto …6.1
- CVE-2021-3674A flaw was found in rizin. The create_section_from_phdr func…7.8
- CVE-2021-36740Varnish Cache, with HTTP/2 enabled, allows request smuggling…6.5
- CVE-2021-36742A improper input validation vulnerability in Trend Micro Ape…7.8
- CVE-2021-36744Trend Micro Security (Consumer) 2021 and 2020 are vulnerable…7.8
- CVE-2021-36745A vulnerability in Trend Micro ServerProtect for Storage 6.0…9.8
- CVE-2021-36746Blackboard Learn through 9.1 allows XSS by an authenticated …5.4
- CVE-2021-36747Blackboard Learn through 9.1 allows XSS by an authenticated …5.4
- CVE-2021-36748A SQL Injection issue in the list controller of the Prestaho…7.5
Are you affected by CVE-2021-36741?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST