CVE-2023-0587

2023-02-0103:15:08

CWE-434

[email protected]

web.nvd.nist.gov

158

cve-2023-0587

file upload vulnerability

trend micro apex one

build 11110

security vulnerability

nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.1%

JSON

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.

Affected configurations

NVD

Node

trendmicroapex_oneMatch--

CPENameOperatorVersion
trendmicro:apex_onetrendmicro apex oneeq-

CPE	Name	Operator	Version
trendmicro:apex_one	trendmicro apex one	eq	-

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Trend Micro Apex One",
    "versions": [
      {
        "version": "Build 11110",
        "status": "affected"
      }
    ]
  }
]