CVE-2023-52091: Trend Micro Apex One Anti-Spyware Engine Link Following Local Privilege Escalation Vulnerability
An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Anti-Spyware Engine, running within the Apex One RealTime Scan service. By creating a junction, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52091?
CVE-2023-52091 is classified as a medium-severity vulnerability that may allow local privilege escalation.
How do I fix CVE-2023-52091?
To mitigate CVE-2023-52091, users should update Trend Micro Apex One to the latest version provided by the vendor.
What are the affected versions for CVE-2023-52091?
CVE-2023-52091 affects Trend Micro Apex One versions up to 14.0.12849 and the 2019 version.
Who can exploit CVE-2023-52091?
Only local attackers with the ability to execute low-privileged code on the system can exploit CVE-2023-52091.
What type of vulnerability is CVE-2023-52091?
CVE-2023-52091 is an anti-spyware engine link following vulnerability that can lead to privilege escalation.