CVE-2025-31283
low-risk
Published 2025-04-02
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Do I need to act?
-
0.13% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.6/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Trend Vision One
Affected Vendors
References (1)
Vendor Advisory
https://success.trendmicro.com/en-US/solution/KA-0019386
25
/ 100
low-risk
Severity
19/34 · Moderate
Exploitability
1/34 · Minimal
Exposure
5/34 · Minimal