CVE-2024-39753: Trend Micro Apex One modOSCE SQL Injection Remote Code Execution Vulnerability
An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is required to exploit this vulnerability. The specific flaw exists within the client management functionality. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of IUSR.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39753?
CVE-2024-39753 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-39753?
To fix CVE-2024-39753, you should apply the latest patches or updates from Trend Micro for Apex One.
What systems are affected by CVE-2024-39753?
CVE-2024-39753 affects installations of Trend Micro Apex One that have not been updated.
Can CVE-2024-39753 be exploited remotely?
Yes, CVE-2024-39753 can be exploited remotely if the attacker has obtained the ability to execute low-privileged code on the target system.
What type of vulnerability is CVE-2024-39753?
CVE-2024-39753 is classified as an SQL Injection vulnerability.