CVE-2024-36303

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2024-36302.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Apex One	>= 2019 (14.0), < 14.0.0.12980
Trend Micro, Inc.	Trend Micro Apex One as a Service	>= SaaS, < 14.0.13139
trendmicro	apex_one	>= 2019, < 14.0.0.12980

References

https://success.trendmicro.com/dcx/s/solution/000298063Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-24-570/Third Party Advisory, VDB Entry
https://success.trendmicro.com/dcx/s/solution/000298063Broken Link
https://www.zerodayinitiative.com/advisories/ZDI-24-570/Third Party Advisory, VDB Entry

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-363047.0A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala CVE-2024-363057.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2024-363065.5A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to c CVE-2024-363075.5A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sen CVE-2024-363094.6Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part o CVE-2024-36314.3The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m CVE-2024-363104.6Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SM CVE-2024-363114.6A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input valid CVE-2024-363155.7Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sens CVE-2024-363165.5The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denia CVE-2024-363196.3Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causin CVE-2024-36326.8The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attac