Paper/Archive/CVE-2023-32557

CVE-2023-32557

Trend Micro, Inc. Trend Micro Apex One — A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 68.7.687 × 2013.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.

Affected

ProductAffectedFixed inSource

Trend Micro Apex One2019 – < 14.0.0.1202414.0.0.12024CNA

trend_micro_apex_one2019 – < 14.0.0.1202414.0.0.12024CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsuccess.trendmicro.com/dcx/s/solution/000293108?language=en_US