PT-2023-4351 · Trend Micro · Trend Micro Apex Central
Poh Jia Hao
·
Publicado
2023-07-26
·
Atualizado
2024-01-29
·
CVE-2023-38625
CVSS v2.0
8.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Trend Micro Apex Central versions prior to build 6481
Trend Micro Apex Central 2019 version <= Build 6394
Description
The issue is related to insufficient validation of incoming requests in the modDeepSecurity widget of the monitoring panel of Trend Micro Apex Central. This could allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack, enabling interaction with internal or local services directly. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.
Recommendations
For Trend Micro Apex Central 2019 versions prior to build 6481, update to a version with build 6481 or later to resolve the issue.
For Trend Micro Apex Central 2019 version <= Build 6394, update to a version with build higher than 6394 to mitigate the risk.
As a temporary workaround, consider restricting access to the modDeepSecurity widget until a patch is available.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Trend Micro Apex Central