CVE-2025-49155

{"id": "CVE-2025-49155", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-06-17T19:15:33.130", "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019917", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}, {"lang": "es", "value": "Una vulnerabilidad en la ruta de b\u00fasqueda no controlada en el m\u00f3dulo Trend Micro Apex One Data Loss Prevention podr\u00eda permitir que un atacante inyecte c\u00f3digo malicioso que provoque la ejecuci\u00f3n de c\u00f3digo arbitrario en las instalaciones afectadas."}], "lastModified": "2025-09-09T15:24:13.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*", "vulnerable": true, "matchCriteriaId": "E2378C4C-B4CE-42E6-A506-2AF1B894E421", "versionEndExcluding": "14.0.14492"}, {"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*", "vulnerable": true, "matchCriteriaId": "2C42CC6D-7812-4564-8002-3E1208E603B8", "versionEndExcluding": "14.0.0.14002", "versionStartIncluding": "14.0.0.12994"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}