CVE-2023-52330: Trend Micro Apex Central Cross-Site Scripting Privilege Escalation Vulnerability
A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Other sources
This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the Policy Management functionality. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52330?
CVE-2023-52330 is classified as a medium severity cross-site scripting vulnerability.
How do I fix CVE-2023-52330?
To fix CVE-2023-52330, ensure that you update Trend Micro Apex Central to the latest version provided by Trend Micro.
What products are affected by CVE-2023-52330?
CVE-2023-52330 affects Trend Micro Apex Central and certain versions of Trend Micro Apex One.
What is the nature of the vulnerability in CVE-2023-52330?
CVE-2023-52330 allows a remote attacker to execute arbitrary code on the affected installations via cross-site scripting.
Does CVE-2023-52330 require user interaction to be exploited?
Yes, CVE-2023-52330 requires user interaction as the victim must visit a malicious page to exploit the vulnerability.