CVE-2023-52325
CVE-2023-52325
In short
A flaw in Trend Micro Apex Central's widgets allows an attacker with valid login credentials to include and execute arbitrary code on the server. This requires combining with another vulnerability and authentication access to work.
Technical detail
Local file inclusion (LFI) vulnerability in Apex Central widget processing enables arbitrary code execution via path traversal or file parameter manipulation. Exploitation requires valid system credentials and chaining with an additional vulnerability; the attack vector is network-based but authentication-gated, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.
Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Trend Micro, Inc. · Trend Micro Apex CentralWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →