CVE-2023-32523 Auth bypass in Trend Micro Moibile Security for Enterprise
Remote attackers with low-privileged code execution can bypass authentication in Trend Micro Mobile Security Enterprise widgets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32523?
CVE-2023-32523 is a high-severity authentication bypass vulnerability in Trend Micro Moibile Security for Enterprise, published on 26 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32524.
Weakness: CWE-287
Which versions are affected by CVE-2023-32523?
It affects 1 product.
Products include Trendmicro Mobile Security.
How do I fix CVE-2023-32523?
No fix has been published for CVE-2023-32523 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-32523 being exploited?
There is no known exploitation of CVE-2023-32523 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro Moibile Security for Enterprise
- CVE-2019-19690 Security feature bypass in Trend Micro Mobile Security for Android (Consumer)
- CVE-2017-14078 SQL injection in Mobile Security (Enterprise)
- CVE-2017-14080 Auth bypass in Mobile Security (Enterprise)
- CVE-2023-32521 Path traversal in Trend Micro Moibile Security for Enterprise
- CVE-2022-40980 Missing authorization in Trend Micro Mobile Security for Enterprise
Sources
Also known as GHSA-3pcr-4vgr-x46g.