CVE-2023-32557

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Apex One	>= 2019, < 14.0.0.12024
trend_micro_inc	trend_micro_apex_one	>= 2019, < 14.0.0.12024

References

https://success.trendmicro.com/dcx/s/solution/000293108?language=en_USPatch, Vendor Advisory
https://success.trendmicro.com/dcx/s/solution/000293108?language=en_USPatch, Vendor Advisory

Timeline

Published: Jun 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-325587.5The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all u CVE-2023-325597.5A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use CVE-2023-32568.1Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.CVE-2023-325609.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co CVE-2023-325617.5A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentica CVE-2023-325629.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t CVE-2023-325639.8An unauthenticated attacker could achieve the code execution through a RemoteControl server.CVE-2023-325649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-325659.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. F CVE-2023-325669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. F CVE-2023-325679.8Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236 CVE-2023-325687.2An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application doe