CVE-2023-0587 File upload in Trend Micro Apex One
An unauthenticated remote attacker can upload arbitrary files to fill the server's file system, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0587?
CVE-2023-0587 is a critical vulnerability in Trendmicro Apex One, published on 1 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.
Weakness: CWE-434
Which versions are affected by CVE-2023-0587?
It affects 1 product.
Products include Trendmicro Apex One.
How do I fix CVE-2023-0587?
No fix has been published for CVE-2023-0587 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0587 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0587 exists.
Other vulnerabilities in Trendmicro Apex One
- CVE-2020-8599 Trend Micro Apex One and OfficeScan Authentication Bypass
- CVE-2025-54948 Trend Micro Apex One OS Command Injection
- CVE-2021-36741 Trend Micro Multiple Products Improper Input Validation
- CVE-2020-8467 Trend Micro Apex One and OfficeScan Remote Code Execution
- CVE-2020-8468 Trend Micro Multiple Products Content Validation Escape
Sources
Also known as GHSA-c5w3-r59j-638h.