CVE-2021-25237: Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
An improper access control vulnerability in Trend Micro Apex One (on-prem) could allow an unauthenticated user to obtain information about the managing port used by agents.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25237?
CVE-2021-25237 is classified as a medium severity vulnerability.
How do I fix CVE-2021-25237?
To fix CVE-2021-25237, it is recommended to apply the latest security updates provided by Trend Micro for Apex One.
Who is affected by CVE-2021-25237?
CVE-2021-25237 affects Trend Micro Apex One installations, particularly version 2019.
What type of vulnerability is CVE-2021-25237?
CVE-2021-25237 is an improper access control vulnerability.
What can attackers do exploiting CVE-2021-25237?
Exploiting CVE-2021-25237 allows attackers to disclose sensitive information about the managing port used by agents.