PT-2023-9183 · Trend Micro · Trend Micro Apex One+1

Published

2023-10-03

·

Updated

2024-10-04

·

CVE-2024-36306

CVSS v3.1

6.1

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified) Trend Micro Apex One as a Service (affected versions not specified)
Description A link following issue in the Damage Cleanup Engine of Trend Micro Apex One and Apex One as a Service could allow a local attacker to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The vulnerability is related to incorrect link resolution before accessing a file.
Recommendations For Trend Micro Apex One, consider disabling the Damage Cleanup Engine as a temporary workaround until a patch is available. For Trend Micro Apex One as a Service, restrict access to the Damage Cleanup Engine to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2024-04444
CVE-2024-36306
ZDI-24-568

Affected Products

Trend Micro Apex One
Trend Micro Apex One As A Service