Cross-Site Scripting Flaw in Trend Micro Apex Central Dashboard Widgets
CVE-2023-32533

6.1MEDIUM

Key Information:

Vendor
Trend Micro
Status
Trend Micro Apex Central
Vendor
CVE Published:
26 June 2023

Summary

The dashboard widgets in Trend Micro Apex Central (on-premise) are susceptible to cross-site scripting (XSS) vulnerabilities. An attacker exploiting this flaw could execute arbitrary code on the affected server, potentially leading to significant security risks and data breaches. This vulnerability is part of a series of related issues but presents a unique method for compromising the server's integrity.

Affected Version(s)

Trend Micro Apex Central 2019 (8.0) < 8.0.0.6394

References

https://success.trendmicro.com/dcx/s/solution/000293107?l...
https://www.zerodayinitiative.com/advisories/ZDI-23-726/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.