PT-2023-1526 · Trend Micro · Trend Micro Apex One

Abdelhamid Naceri · CVE-2023-25144 · Published 2023-02-09 · Updated 2023-03-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified)

Description The issue is related to improper access control in the Trend Micro Apex One agent, which could allow a local attacker to gain elevated privileges. This can enable the creation of arbitrary directories with arbitrary ownership. The vulnerability is also associated with insufficient access control to the Suspect folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-264

CWE-269

Related Identifiers

BDU:2023-00969

CVE-2023-25144

ZDI-23-171

Affected Products

Trend Micro Apex One

References · 8

• https://osv.dev/vulnerability/CVE-2023-25144 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-25144 · Security Note
• https://bdu.fstec.ru/vul/2023-00969 · Security Note
• https://success.trendmicro.com/solution/000292209 · Vendor Advisory
• https://success.trendmicro.com/dcx/s/solution/000292209?language=en_US · Note
• https://egfincirt.org.eg/trend-micro-security-update-12-february-2023 · Note
• https://cybersecurity-help.cz/vdb/SB2023020957 · Note