CVE-2023-52331 is a server-side request forgery in Trend Micro Apex Central 2019 on premises builds before 6570. NVD scores it high at 7.1, while Trend Micro and ZDI score it 9.1. It needs authentication. Apply Patch 8 r2 (build 6660) or later.
What's affected
The NVD record lists Trend Micro Apex Central 2019. Trend Micro's bulletin of 9 January 2024 gives more detail: the affected product is Apex Central 2019, on premises builds before 6570, on Windows. The fix is Patch 8 r2 (build 6660, repacked), and the bulletin says it is available now. The bulletin is shared with several other Apex Central CVEs from the same release.
The record's weakness is CWE-918, server-side request forgery, and its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which gives 7.1 (High).
The severity differs between sources. Trend Micro's bulletin and ZDI advisory ZDI-24-052 give 9.1, with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, which changes the scope and adds an availability effect. NVD keeps the scope unchanged and scores 7.1. I use the NVD figure in the title and name both here. ZDI places the flaw in the modVulnerabilityProtect module, where a URI is not validated before resources are accessed, and says information can be disclosed in the context of the service account.
How to check if you're exposed
Apex Central is installed on Windows. The simplest check is the build number shown in the product's console and in the installed programs list on the server, which you compare against the bulletin: builds before 6570 are listed as affected, and the bulletin names build 6660 as the fixed one.
I did not find an exact menu path in the sources, so follow Trend Micro's readme for Patch 8 r2 for the supported way to confirm the build. Note also that the bulletin tells customers to use the newest patch available, since some of the listed CVEs may have been fixed earlier.
Beyond the version, check who can sign in to the console. Every Apex Central issue in this group needs a valid account or chains with another flaw, so the account list and the network path to the console are part of your exposure.
What to do now
- Identify every Apex Central server and its build number.
- Apply Patch 8 r2 (build 6660) or the newest patch Trend Micro offers, following the readme and the prerequisites in the bulletin.
- Limit network access to the management console to administrator networks, and review remote access to the server, as the bulletin advises.
- Review the console accounts. Remove accounts that are unused and make sure the remaining ones use strong, unique credentials.
- Review which internal services accept requests from the Apex Central server without their own authentication. Record the patch in your change log so an audit can see when it was applied.
Why it matters
Server-side request forgery makes the server itself send a request that an attacker chose. The record says the attacker can interact with internal or local services directly. That matters because internal services often trust any caller on the same machine or network and expose data or functions with no further login.
The bulletin adds that the attacker must first be able to run low privileged code on the target. The difference in scope between the two scores comes down to whether you believe the reach extends beyond the vulnerable component, which in practice depends on what else listens on that server. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you keep track of the components you run and the advisories that apply to them.
Quick check
Which score should I use for CVE-2023-52331?
Use the one your policy names, and note that the sources differ: NVD gives 7.1 and Trend Micro and ZDI give 9.1. The patch is the same either way.
What does the SSRF reach?
The record says internal or local services. What that includes depends on what runs on or near your Apex Central server, so review which services trust requests from it.
Sources
- Trend Micro security bulletin for Apex Central, 9 January 2024
- Zero Day Initiative advisory ZDI-24-052
- Gold page for CVE-2023-52331
Last reviewed: 19 October 2026.
