CVE-2022-24239

CriticalCVSS 9.8

Published: 02/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.97%

58th percentile - higher than 58% of all known CVEs

Summary

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.

Risk Assessment

The risk includes remote code execution, server compromise, and data theft or modification.

Recommendation

Immediately update ACEweb Online Portal to the latest version and implement file type validation and size restrictions for uploaded attachments.

Original NVD description (English source)

ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.