Login Request a demo
High severity · published Jan 23, 2024
CVE-2023-52324
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations
8.8
CVSS
4.1%
EPSS
No
On KEV
Description
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
Trend Micro Apex Central · Trend Micro, Inc.
2019 before 8.0.0.6570 · source: vendor
AC
Apex Central · Trendmicro
2019 · source: NVD
Affected product
TM
Trend Micro Apex Central
Trend Micro, Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-52324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-52324
Vendor Advisory
https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-077/
More from Trend Micro Apex Central
7.5
CVE-2023-52325
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations
7.1
CVE-2023-52331
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly
6.1
CVE-2023-52330
A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central
6.1
CVE-2023-52329
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution…
6.1
CVE-2023-52328
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution…