ZDI-24-021: Trend Micro Apex Central Cross-Site Scripting Remote Code Execution Vulnerability
First published: Wed Jan 10 2024(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the PageSize parameter provided to the operation.php component. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to execute script in the context of the current user.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro Apex Central |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-24-021?
ZDI-24-021 has been categorized as a remote code execution vulnerability with a high severity due to its potential impact.
How do I fix ZDI-24-021?
To fix ZDI-24-021, ensure that your Trend Micro Apex Central is updated to the latest version as per the vendor's advisories.
What type of attack does ZDI-24-021 involve?
ZDI-24-021 involves remote attackers executing arbitrary code through user interaction with malicious pages or files.
What software is affected by ZDI-24-021?
ZDI-24-021 affects installations of Trend Micro Apex Central.
Is user interaction required to exploit ZDI-24-021?
Yes, exploiting ZDI-24-021 requires user interaction to visit a malicious page or open a malicious file.
- agent/last-modified-date
- agent/type
- agent/first-publish-date
- agent/title
- collector/zdi-published
- source/ZDI
- alias/ZDI-CAN-18870
- collector/zdi-advisory
- alias/ZDI-24-021
- alias/CVE-2023-52328
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/description
- agent/softwarecombine
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/trend micro
- canonical/trend micro apex central