Medium WID-SEC-2024-0047 13 CVEs

Trend Micro Apex One und Apex Central: Mehrere Schwachstellen

Published Jan 9, 2024 · Updated Jan 11, 2024 · Revision 2 · de-DE

Vendor: Trend Micro Product: Apex Central < Patch 8 (b6658) Product: Apex One Product: Apex One < SP1 CP b12534 Product: Apex One as a service < 14.0.12849 Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Trend Micro Apex One und Trend Micro Apex Central ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.

Product

Trend Micro Apex One ist eine Endpoint-Security Lösung.
Trend Micro Apex Central ist eine webbasierte Konsole, die eine zentrale Verwaltung für Trend Micro-Produkte und -Dienste bietet.

Vulnerabilities 13

High 8.8

CVE-2023-52324

An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
High 7.8

CVE-2023-52090

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…

Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service

Jan 23, 2024
High 7.8

CVE-2023-52091

An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate pr…

Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service

Jan 23, 2024
High 7.8

CVE-2023-52092

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…

Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service

Jan 23, 2024
High 7.8

CVE-2023-52094

An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the upd…

Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service

Jan 23, 2024
High 7.5

CVE-2023-52325

A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to exec…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
High 7.4

CVE-2023-52093

An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate …

Trend Micro Trend Micro Apex One Trend Micro Apex One as a Service

Jan 23, 2024
High 7.1

CVE-2023-52331

A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attack…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
Medium 6.1

CVE-2023-52326

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
Medium 6.1

CVE-2023-52327

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
Medium 6.1

CVE-2023-52328

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
Medium 6.1

CVE-2023-52329

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…

Trend Micro Trend Micro Apex Central

Jan 23, 2024
Medium 6.1

CVE-2023-52330

A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary cod…

Trend Micro Trend Micro Apex Central

Jan 23, 2024

Revision history

2024-01-11 #2
CVE-Nummern ergänzt
2024-01-09 #1
Initiale Fassung

References

Trend Micro Security Bulletin vom 2024-01-09
https://success.trendmicro.com/dcx/s/solution/000296151?language=en_US
Trend Micro Security Bulletin vom 2024-01-09
https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US