Lucene search

TrendmicroCVE-2023-0587

HistoryFeb 01, 2023 - 3:15 a.m.

CVE-2023-0587

2023-02-0103:15:08

CWE-434

trendmicro

web.nvd.nist.gov

167

cve-2023-0587

file upload vulnerability

trend micro apex one

build 11110

security vulnerability

nvd

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

59.2%

JSON

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.

Affected configurations

Nvd

Node

trendmicroapex_oneMatch--

VendorProductVersionCPE
trendmicroapex_one-cpe:2.3:a:trendmicro:apex_one:-:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	-	cpe:2.3:a:trendmicro:apex_one:-:-::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Trend Micro Apex One",
    "versions": [
      {
        "version": "Build 11110",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2023-5

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

59.2%

JSON

Related for CVE-2023-0587