CVE-2023-32523: Trend Micro Mobile Security for Enterprises widget WFUser Authentication Bypass Vulnerability
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32524.
Other sources
This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro Mobile Security for Enterprises. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WFUser class defined within the web/widget path. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32523?
CVE-2023-32523 is a critical vulnerability in Trend Micro Mobile Security for Enterprises widget WFUser Authentication Bypass.
How severe is CVE-2023-32523?
CVE-2023-32523 has a severity rating of 9.8, which is considered critical.
How does CVE-2023-32523 impact Trend Micro Mobile Security for Enterprises?
CVE-2023-32523 allows remote attackers to bypass authentication on affected installations of Trend Micro Mobile Security for Enterprises, without requiring authentication to exploit the vulnerability.
Which software versions are affected by CVE-2023-32523?
The vulnerability affects Trend Micro Mobile Security for Enterprises version 9.8, service pack 5 (9.8-sp5).
How can I fix CVE-2023-32523?
To fix CVE-2023-32523, it is recommended to upgrade to the latest version of Trend Micro Mobile Security for Enterprises.