CVE-2023-52338: Trend Micro Deep Security Link Following Local Privilege Escalation Vulnerability

Published Jan 23, 2024

Updated

A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Other sources

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Deep Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Trend Micro Anti-Malware Solution Platform. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

— ZDI

Affected Software

51 affected components

Trend Micro Deep Security

trendmicro Deep Security=20.0

trendmicro Deep Security Agent=20.0-update1337

trendmicro Deep Security Agent=20.0-update1559

trendmicro Deep Security Agent=20.0-update158

trendmicro Deep Security Agent=20.0-update167

trendmicro Deep Security Agent=20.0-update1681

trendmicro Deep Security Agent=20.0-update173

trendmicro Deep Security Agent=20.0-update180

trendmicro Deep Security Agent=20.0-update182

trendmicro Deep Security Agent=20.0-update1822

trendmicro Deep Security Agent=20.0-update183

trendmicro Deep Security Agent=20.0-update1876

trendmicro Deep Security Agent=20.0-update190

trendmicro Deep Security Agent=20.0-update198

trendmicro Deep Security Agent=20.0-update2009

trendmicro Deep Security Agent=20.0-update208

trendmicro Deep Security Agent=20.0-update213

trendmicro Deep Security Agent=20.0-update2204

trendmicro Deep Security Agent=20.0-update223

trendmicro Deep Security Agent=20.0-update224

trendmicro Deep Security Agent=20.0-update2419

trendmicro Deep Security Agent=20.0-update2593

trendmicro Deep Security Agent=20.0-update2740

trendmicro Deep Security Agent=20.0-update2921

trendmicro Deep Security Agent=20.0-update3165

trendmicro Deep Security Agent=20.0-update3288

trendmicro Deep Security Agent=20.0-update3445

trendmicro Deep Security Agent=20.0-update3530

trendmicro Deep Security Agent=20.0-update3771

trendmicro Deep Security Agent=20.0-update3964

trendmicro Deep Security Agent=20.0-update4185

trendmicro Deep Security Agent=20.0-update4416

trendmicro Deep Security Agent=20.0-update4726

trendmicro Deep Security Agent=20.0-update4959

trendmicro Deep Security Agent=20.0-update5137

trendmicro Deep Security Agent=20.0-update5394

trendmicro Deep Security Agent=20.0-update5512

trendmicro Deep Security Agent=20.0-update5810

trendmicro Deep Security Agent=20.0-update5995

trendmicro Deep Security Agent=20.0-update6313

trendmicro Deep Security Agent=20.0-update6690

trendmicro Deep Security Agent=20.0-update6860

trendmicro Deep Security Agent=20.0-update7119

trendmicro Deep Security Agent=20.0-update7303

trendmicro Deep Security Agent=20.0-update7476

trendmicro Deep Security Agent=20.0-update7719

trendmicro Deep Security Agent=20.0-update7943

trendmicro Deep Security Agent=20.0-update8137

trendmicro Deep Security Agent=20.0-update8268

trendmicro Deep Security Agent=20.0-update877

Event History

Jan 23, 2024

CVE Published

via MITRE·08:43 PM

Data Sourced

via MITRE·08:43 PM

Description

Feb 24, 2025

Advisory Published

via ZDI·09:35 AM

Frequently Asked Questions

What is the severity of CVE-2023-52338?

CVE-2023-52338 has been classified as a high severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2023-52338?

To remediate CVE-2023-52338, update affected Trend Micro Deep Security 20.0 and Cloud One - Endpoint and Workload Security Agent installations to the latest version.

Who is affected by CVE-2023-52338?

CVE-2023-52338 affects users of Trend Micro Deep Security 20.0 and the Trend Micro Cloud One - Endpoint and Workload Security Agent.

What type of vulnerability is CVE-2023-52338?

CVE-2023-52338 is categorized as a link following vulnerability that can allow local attackers to escalate privileges.

Is CVE-2023-52338 being actively exploited?

As of now, there are no confirmed reports of active exploitation for CVE-2023-52338.