PT-2023-1526 · Trend Micro · Trend Micro Apex One

Abdelhamid Naceri · Publicado 2023-02-09 · Atualizado 2023-03-16 · CVE-2023-25144

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified)

Description The issue is related to improper access control in the Trend Micro Apex One agent, which could allow a local attacker to gain elevated privileges. This can enable the creation of arbitrary directories with arbitrary ownership. The vulnerability is also associated with insufficient access control to the Suspect folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-264

CWE-269

Identificadores relacionados

BDU:2023-00969

CVE-2023-25144

ZDI-23-171

Produtos afetados

Trend Micro Apex One

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-25144 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-171 · Nota de Segurança
• https://success.trendmicro.com/dcx/s/solution/000292209?language=en_US · Nota
• https://egfincirt.org.eg/trend-micro-security-update-12-february-2023 · Nota
• https://cybersecurity-help.cz/vdb/SB2023020957 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25144 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-00969 · Nota de Segurança
• https://success.trendmicro.com/solution/000292209 · Aviso do Fabricante