CVE-2022-24252
HighCVSS 8.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
Risk Assessment
An attacker can take over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update Extensis Portfolio to the latest version; if unavailable, restrict access to the FileTransferServlet component to trusted users and implement file type validation.
Other vulnerabilities in Extensis Portfolio
See all- CVE-2022-24255High
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
- CVE-2022-24254High
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- CVE-2022-24253High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
- CVE-2022-24251High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
Original NVD description (English source)
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.