CVE-2023-25148

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-251498.8TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During instaCVE-2023-25158.8Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privilegeCVE-2023-251505.7Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be trCVE-2023-251517.5opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentaCVE-2023-251528.8Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and direCVE-2023-251535.5containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the nuCVE-2023-251546.1Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appeCVE-2023-251556.5Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDCVE-2023-251569.8Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt bruCVE-2023-251579.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support CVE-2023-251589.8GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression languagCVE-2023-251595.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collabor
CVE-2023-25148: High severity, CVSS 7.8 | Vulnix