CVE-2023-38626
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38625.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- trendmicro/apex central
- Source
- security@trendmicro.com
References
- https://success.trendmicro.com/dcx/s/solution/000294176?language=en_USVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-23-1000/Third Party Advisory, VDB Entry
- https://success.trendmicro.com/dcx/s/solution/000294176?language=en_USVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-23-1000/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.