SB2023051302 - Multiple vulnerabilities in Trend Micro Mobile Security for Enterprise

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023051302

SB2023051302 - Multiple vulnerabilities in Trend Micro Mobile Security for Enterprise

Published: May 13, 2023 Updated: May 14, 2023

Security Bulletin ID SB2023051302
Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 63% Medium 38%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2023-32521)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote non-authenticated attacker can send a specially crafted HTTP request and delete arbitrary files on the system.


2) PHP file inclusion (CVE-ID: CVE-2023-32528)

The vulnerability allows a remote user to include and execute arbitrary PHP files on the server.

The vulnerability exists due to incorrect input validation when including PHP files within the getWidgetPoolManager function defined in the web/widgetforsecurity path. A remote user can send a specially crafted HTTP request to the affected application, include and execute arbitrary PHP code on the system with privileges of the web server.


3) Path traversal (CVE-ID: CVE-2023-32522)

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and delete arbitrary files on the system.


4) Improper Authentication (CVE-ID: CVE-2023-32523)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication within the WFUser class defined in the web/widget path. A remote attacker can bypass authentication process and gain unauthorized access to the application.


5) Improper Authentication (CVE-ID: CVE-2023-32524)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication within the WFUser class defined in the web/widgetforsecurity path. A remote attacker can bypass authentication process and gain unauthorized access to the application.


6) Arbitrary file upload (CVE-ID: CVE-2023-32525)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the set_certificates_config action defined in the web/widget path. A remote user can upload a malicious file and execute it on the server.


7) Arbitrary file upload (CVE-ID: CVE-2023-32526)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the set_certificates_config action defined in the web/widgetforsecurity path. A remote user can upload a malicious file and execute it on the server.


8) PHP file inclusion (CVE-ID: CVE-2023-32527)

The vulnerability allows a remote user to include and execute arbitrary PHP files on the server.

The vulnerability exists due to incorrect input validation when including PHP files within the getWidgetPoolManager function defined in the web/widget path. A remote user can send a specially crafted HTTP request to the affected application, include and execute arbitrary PHP code on the system with privileges of the web server.


Remediation

Install update from vendor's website.

References