CVE-2022-24251
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
Risk Assessment
The risk involves potential remote code execution or server takeover through malicious file upload, which could compromise the confidentiality, integrity, and availability of organizational data.
Recommendation
It is recommended to immediately update Extensis Portfolio to the latest version and implement validation mechanisms for file types and sizes.
Other vulnerabilities in Extensis Portfolio
See all- CVE-2022-24255High
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
- CVE-2022-24254High
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- CVE-2022-24253High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
- CVE-2022-24252High
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
Original NVD description (English source)
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function.