Paper/Archive/CVE-2024-57968

CVE-2024-57968

Advantive VeraCore — Advantive VeraCore Unrestricted File Upload Vulnerability

KEV · due 31 Mar EPSS 32%public exploit SSVC act CVSS 9.9

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 In CISA KEV+3030.0 EPSS percentile 98.3.983 × 2019.7 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

Affected

ProductAffectedFixed inSource

VeraCore< 2024.4.2.12024.4.2.1CNA

Scores by source

mitre (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refsolissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days refadvantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1 refintezer.com/blog/research/xe-group-exploiting-zero-days refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57968 kevcisa.gov/known-exploited-vulnerabilities-catalog