PT-2023-4352 · Trend Micro · Trend Micro Apex Central

Izobashi + 1 · Publicado 2023-07-26 · Atualizado 2024-01-29 · CVE-2023-38627

Positive Technologies (AI Summary)

CVSS v2.0

8.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central versions prior to build 6481

Description A server-side request forgery (SSRF) vulnerability could allow an attacker to interact with internal or local services directly. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. The vulnerability is related to insufficient validation of incoming requests in the modTXSO widget module of the monitoring and security management tool.

Recommendations For Trend Micro Apex Central versions prior to build 6481, update to a version with build 6481 or later to resolve the issue. As a temporary workaround, consider restricting access to the modTXSO widget module to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2023-04696

CVE-2023-38627

ZDI-23-1001

Produtos afetados

Trend Micro Apex Central

Referências · 9

• https://zerodayinitiative.com/advisories/ZDI-23-1001 · Nota de Segurança
• https://t.me/cvenotify/68423 · Publicação no Telegram
• https://t.me/cvenotify/68520 · Publicação no Telegram
• https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023072643 · Nota
• https://bdu.fstec.ru/vul/2023-04696 · Nota de Segurança
• https://t.me/cvenotify/68517 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38627 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38627 · Nota de Segurança