CVE-2025-49155

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-49155", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2025-06-02T17:43:08.724Z", "datePublished": "2025-06-17T18:42:31.517Z", "dateUpdated": "2025-06-17T20:22:40.129Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"version": "2019 (14.0)", "status": "affected", "versionType": "semver", "lessThan": "14.0.0.14002"}], "cpes": ["cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:*:*:*:*:*:*"]}, {"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"version": "SaaS", "status": "affected", "versionType": "semver", "lessThan": "14.0.14492"}], "cpes": ["cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T18:42:31.517Z"}, "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "problemTypes": [{"descriptions": [{"description": "CWE-427: Uncontrolled Search Path Element", "lang": "en-US", "type": "CWE", "cweId": "CWE-427"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-17T20:22:23.426414Z", "id": "CVE-2025-49155", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:22:40.129Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-17T20:22:23.426414Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:22:34.788Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:*:*:*:*:*:*"], "vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"status": "affected", "version": "2019 (14.0)", "lessThan": "14.0.0.14002", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga:*:*:*:*:*:*"], "vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"status": "affected", "version": "SaaS", "lessThan": "14.0.14492", "versionType": "semver"}]}], "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T18:42:31.517Z"}}}, "cveMetadata": {"cveId": "CVE-2025-49155", "state": "PUBLISHED", "dateUpdated": "2025-06-17T20:22:40.129Z", "dateReserved": "2025-06-02T17:43:08.724Z", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "datePublished": "2025-06-17T18:42:31.517Z", "assignerShortName": "trendmicro"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:*:*:*:*:*:*"], "product": "Trend Micro Apex One", "vendor": "Trend Micro, Inc.", "versions": [{"lessThan": "14.0.0.14002", "status": "affected", "version": "2019 (14.0)", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga:*:*:*:*:*:*"], "product": "Trend Micro Apex One as a Service", "vendor": "Trend Micro, Inc.", "versions": [{"lessThan": "14.0.14492", "status": "affected", "version": "SaaS", "versionType": "semver"}]}], "source": "security@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*", "matchCriteriaId": "E2378C4C-B4CE-42E6-A506-2AF1B894E421", "versionEndExcluding": "14.0.14492", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*", "matchCriteriaId": "2C42CC6D-7812-4564-8002-3E1208E603B8", "versionEndExcluding": "14.0.0.14002", "versionStartIncluding": "14.0.0.12994", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}, {"lang": "es", "value": "Una vulnerabilidad en la ruta de b\u00fasqueda no controlada en el m\u00f3dulo Trend Micro Apex One Data Loss Prevention podr\u00eda permitir que un atacante inyecte c\u00f3digo malicioso que provoque la ejecuci\u00f3n de c\u00f3digo arbitrario en las instalaciones afectadas."}], "id": "CVE-2025-49155", "lastModified": "2026-06-17T09:30:50.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49155", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-17T20:22:23.426414Z", "version": "2.0.3"}}]}, "published": "2025-06-17T19:15:33.130", "references": [{"source": "security@trendmicro.com", "tags": ["Vendor Advisory"], "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"}, {"source": "security@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security@trendmicro.com", "type": "Secondary"}]}

{}

{}