PT-2024-35799 · Trend Micro · Trend Micro Security

Nisha Thakur · Published 2024-12-31 · Updated 2025-01-01 · CVE-2024-53647

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro ID Security versions 3.0 and below

Description The issue allows an attacker to send an unlimited number of email verification requests without restriction, potentially leading to abuse or denial of service.

Recommendations For versions 3.0 and below, consider restricting access to the email verification request feature until a patch is available. As a temporary workaround, limit the number of email verification requests that can be sent within a certain timeframe to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Restriction of Excessive Authentication Attempts

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-307

CWE-770

CWE-400

Related Identifiers

CVE-2024-53647

Affected Products

Trend Micro Security

References · 6

• https://osv.dev/vulnerability/CVE-2024-53647 · Vendor Advisory
• https://helpcenter.trendmicro.com/en-us/article/tmka-06710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53647 · Security Note
• https://twitter.com/CVEnew/status/1874132333130854821 · Twitter Post
• https://t.me/cvedetector/14047 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1874260483806482497 · Twitter Post