Headline

CVE-2023-32524: ZDI-23-588

Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities.

This is similar to, but not identical to CVE-2023-32523.

1 year ago

CVE

Open in Source

#vulnerability #web #auth

May 12th, 2023

Trend Micro Mobile Security for Enterprises widgetforsecurity WFUser Authentication Bypass Vulnerability****ZDI-23-588
ZDI-CAN-19722

CVE ID

CVE-2023-32524

CVSS SCORE

9.8, (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

AFFECTED VENDORS

Trend Micro

AFFECTED PRODUCTS

Mobile Security for Enterprises

VULNERABILITY DETAILS

This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro Mobile Security for Enterprises. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the WFUser class defined within the web/widgetforsecurity path. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.

ADDITIONAL DETAILS

Trend Micro has issued an update to correct this vulnerability. More details can be found at:
https://success.trendmicro.com/solution/000293106

DISCLOSURE TIMELINE