CVE-2023-32524: Trend Micro Mobile Security for Enterprises widgetforsecurity WFUser Authentication Bypass Vulnerability
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32523.
Other sources
This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro Mobile Security for Enterprises. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WFUser class defined within the web/widgetforsecurity path. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32524?
CVE-2023-32524 is a vulnerability that allows remote attackers to bypass authentication on affected installations of Trend Micro Mobile Security for Enterprises.
How severe is CVE-2023-32524?
CVE-2023-32524 has a severity rating of 9.8 (critical).
How can an attacker exploit CVE-2023-32524?
An attacker can exploit CVE-2023-32524 by bypassing authentication on affected installations of Trend Micro Mobile Security for Enterprises without requiring any authentication.
What software versions are affected by CVE-2023-32524?
CVE-2023-32524 affects Trend Micro Mobile Security for Enterprises version 9.8-sp5 on Windows.
Is there a fix for CVE-2023-32524?
Yes, Trend Micro has provided a solution for CVE-2023-32524. Please refer to the references for more information.