CVE-2025-31285

A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://success.trendmicro.com/en-US/solution/KA-0019386	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:trendmicro:trend_vision_one:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-02 17:15

Updated : 2025-09-02 18:33

NVD link : CVE-2025-31285

Mitre link : CVE-2025-31285

CVE.ORG link : CVE-2025-31285

JSON object : View

Products Affected

trendmicro

trend_vision_one

CWE

CWE-269

Improper Privilege Management

NVD-CWE-Other

{"id": "CVE-2025-31285", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "[email protected]"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-04-02T17:15:48.943", "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019386", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. \r\n\r\nPlease note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso fallida, descubierta previamente en el componente Trend Vision One Role Name, podr\u00eda haber permitido a un administrador crear usuarios que posteriormente podr\u00edan cambiar el rol de la cuenta y, en \u00faltima instancia, escalar privilegios. Nota: Este problema ya se ha solucionado en el servicio backend y ya no se considera una vulnerabilidad activa."}], "lastModified": "2025-09-02T18:33:05.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:trend_vision_one:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "761D8AA4-4FAC-4797-84B3-20DA7F69DF8E"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}