CVE-2025-31285

A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://success.trendmicro.com/en-US/solution/KA-0019386	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:trendmicro:trend_vision_one:-:*:*:*:*:*:*:*

History

02 Sep 2025, 18:33

Type	Values Removed	Values Added
First Time		Trendmicro trend Vision One Trendmicro
CWE		NVD-CWE-Other
References	~~() https://success.trendmicro.com/en-US/solution/KA-0019386 -~~	() https://success.trendmicro.com/en-US/solution/KA-0019386 - Vendor Advisory
CPE		cpe:2.3:a:trendmicro:trend_vision_one:-:::::::*

07 Apr 2025, 14:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~0.0~~	v2 : unknown v3 : 4.6
Summary		(es) Una vulnerabilidad de control de acceso fallida, descubierta previamente en el componente Trend Vision One Role Name, podría haber permitido a un administrador crear usuarios que posteriormente podrían cambiar el rol de la cuenta y, en última instancia, escalar privilegios. Nota: Este problema ya se ha solucionado en el servicio backend y ya no se considera una vulnerabilidad activa.

02 Apr 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-02 17:15

Updated : 2025-09-02 18:33

NVD link : CVE-2025-31285

Mitre link : CVE-2025-31285

CVE.ORG link : CVE-2025-31285

JSON object : View

Products Affected

trendmicro

trend_vision_one

CWE

CWE-269

Improper Privilege Management

NVD-CWE-Other

{"id": "CVE-2025-31285", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "security@trendmicro.com"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-04-02T17:15:48.943", "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019386", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@trendmicro.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. \r\n\r\nPlease note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso fallida, descubierta previamente en el componente Trend Vision One Role Name, podr\u00eda haber permitido a un administrador crear usuarios que posteriormente podr\u00edan cambiar el rol de la cuenta y, en \u00faltima instancia, escalar privilegios. Nota: Este problema ya se ha solucionado en el servicio backend y ya no se considera una vulnerabilidad activa."}], "lastModified": "2025-09-02T18:33:05.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:trend_vision_one:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "761D8AA4-4FAC-4797-84B3-20DA7F69DF8E"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}