ZDI-25-236: Trend Micro Apex Central modTMSM Server-Side Request Forgery Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the modTMSM webapp widget. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose sensitive data, leading to further compromise.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2025-30678.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-236?
The vulnerability ZDI-25-236 has been identified as allowing remote attackers to access sensitive information, which can compromise the security of affected systems.
How do I fix ZDI-25-236?
To mitigate the effects of ZDI-25-236, ensure that all relevant software updates and patches from Trend Micro Apex Central are applied as soon as they become available.
What kind of user interaction is needed for ZDI-25-236 to be exploited?
Exploitation of ZDI-25-236 requires the target user to visit a malicious page or open a malicious file.
Which software is affected by ZDI-25-236?
ZDI-25-236 affects installations of Trend Micro Apex Central.
What are the potential consequences of ZDI-25-236?
If exploited, ZDI-25-236 can lead to unauthorized access to sensitive information, exposing users to risk.