Vulnerability in Apple macOS
CVE-2020-24556
A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.
EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apple Macos
- Microsoft Windows
- Trend Micro Apex One — versions 2009 (on premise), SaaS
- Trend Micro Officescan — versions XG SP1
- Trend Micro Worry-free Business Security — versions 10 SP1, Services (SaaS)
- Trendmicro Apex_one — versions 2019, saas
- Trendmicro Worry-free_business_security — versions 10.0
- Trendmicro Worry-free_business_security_services
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@trendmicro.com (x_refsource_MISC, Vendor Advisory)
- security@trendmicro.com (x_refsource_MISC, Vendor Advisory)
- security@trendmicro.com (VDB Entry, Third Party Advisory, x_refsource_MISC)
- security@trendmicro.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-24556?
- CVE-2020-24556 is a high-severity vulnerability in Apple macOS, classified under Improper Link Resolution Before File Access. CVSS score: 7.8/10. Published 2020-09-01.
- How severe is CVE-2020-24556?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2020-24556 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.