CVE-2023-32553 - Vulnerability Details - OpenCVE

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32552.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft	Windows
Trend Micro Inc	Trend Micro Apex One
Trendmicro	Apex One

Configuration 1 [-]

AND

OR	cpe:2.3:a:trendmicro:apex_one:::::saas:::*
	cpe:2.3:a:trendmicro:apex_one:2019:::::::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
https://www.zerodayinitiative.com/advisories/ZDI-23-653/

History

Wed, 04 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Trend Micro Inc Trend Micro Inc trend Micro Apex One
Weaknesses		CWE-346
CPEs		cpe:2.3:a:trend_micro_inc:trend_micro_apex_one::::::::
Vendors & Products		Trend Micro Inc Trend Micro Inc trend Micro Apex One
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: trendmicro

Published: 2023-06-26T21:56:16.388Z

Updated: 2024-12-04T16:23:57.330Z

Reserved: 2023-05-09T18:13:30.118Z

Link: CVE-2023-32553

Vulnrichment

Updated: 2024-08-02T15:18:37.618Z

NVD

Status : Modified

Published: 2023-06-26T22:15:10.803

Modified: 2024-12-04T17:15:09.720

Link: CVE-2023-32553

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32553", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2023-05-09T18:13:30.118Z", "datePublished": "2023-06-26T21:56:16.388Z", "dateUpdated": "2024-12-04T16:23:57.330Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"version": "2019", "status": "affected", "versionType": "semver", "lessThan": "14.0.0.12024"}]}], "descriptions": [{"lang": "en", "value": "An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.\r\n\r\nThis is similar to, but not identical to CVE-2023-32552."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2023-06-26T21:56:16.388Z"}, "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:18:37.618Z"}, "title": "CVE Program Container", "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US", "tags": ["x_transferred"]}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "affected": [{"vendor": "trend_micro_inc", "product": "trend_micro_apex_one", "cpes": ["cpe:2.3:a:trend_micro_inc:trend_micro_apex_one:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "14.0.0.12024", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-04T16:17:26.852354Z", "id": "CVE-2023-32553", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-04T16:23:57.330Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32553", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2023-05-09T18:13:30.118Z", "datePublished": "2023-06-26T21:56:16.388Z", "dateUpdated": "2024-12-04T16:23:57.330Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"version": "2019", "status": "affected", "versionType": "semver", "lessThan": "14.0.0.12024"}]}], "descriptions": [{"lang": "en", "value": "An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.\r\n\r\nThis is similar to, but not identical to CVE-2023-32552."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2023-06-26T21:56:16.388Z"}, "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:18:37.618Z"}, "title": "CVE Program Container", "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US", "tags": ["x_transferred"]}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32553", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-04T16:17:26.852354Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:trend_micro_inc:trend_micro_apex_one:*:*:*:*:*:*:*:*"], "vendor": "trend_micro_inc", "product": "trend_micro_apex_one", "versions": [{"status": "affected", "version": "0", "lessThan": "14.0.0.12024", "versionType": "semver"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-04T16:22:25.716Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:*:*:*", "matchCriteriaId": "2BEB6165-97A6-4EE9-B7D8-66D62469AE79", "versionEndExcluding": "14.0.12105", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*", "matchCriteriaId": "AF019D2D-C426-4D2D-A254-442CE777B41E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.\r\n\r\nThis is similar to, but not identical to CVE-2023-32552."}], "id": "CVE-2023-32553", "lastModified": "2024-12-04T17:15:09.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-06-26T22:15:10.803", "references": [{"source": "security@trendmicro.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"}, {"source": "security@trendmicro.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-653/"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}