CVE-2023-47202: Trend Micro Apex One Local File Inclusion Local Privilege Escalation Vulnerability
A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One web console. The issue results from passing an insecure path to a PHP include function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of IUSR.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-47202?
CVE-2023-47202 is classified as a high severity local file inclusion vulnerability.
How do I fix CVE-2023-47202?
To remediate CVE-2023-47202, apply the latest security updates provided by Trend Micro for Apex One.
What types of systems are affected by CVE-2023-47202?
CVE-2023-47202 affects installations of Trend Micro Apex One, specifically versions up to 14.0.12737 and 2019.
Can CVE-2023-47202 be exploited remotely?
No, CVE-2023-47202 requires a local attacker who has already gained low-privileged access to the target system.
What potential impact does CVE-2023-47202 have?
Exploitation of CVE-2023-47202 may allow an attacker to escalate their privileges on the affected system.