CVE-2023-25147 — Uncontrolled Search Path Element in Micro INC Trend Micro Apex ONE
Severity
6.7MEDIUMNVD
EPSS
0.1%
top 79.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 10
Latest updateOct 15
Description
An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process.
Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9
Affected Packages2 packages
🔴Vulnerability Details
2GHSA▶
GHSA-x6x2-74g9-vjcw: An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the pro↗2023-03-10
CVEList▶
CVE-2023-25147: An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the pro↗2023-03-07