CVE-2023-52324
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.17% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- trendmicro/apex central
- Source
- security@trendmicro.com
References
- https://success.trendmicro.com/dcx/s/solution/000296153?language=en_USVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-24-077/Third Party Advisory, VDB Entry
- https://success.trendmicro.com/dcx/s/solution/000296153?language=en_USVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-24-077/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.