CVE-2022-24253
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
Risk Assessment
The risk involves potential remote code execution or server takeover by uploading a malicious file (e.g., webshell). This could compromise the confidentiality, integrity, and availability of organizational data.
Recommendation
Immediately update Extensis Portfolio to the latest version that fixes this vulnerability. If an update is unavailable, restrict access to the AdminFileTransferServlet component to trusted administrators only.
Other vulnerabilities in Extensis Portfolio
See all- CVE-2022-24255High
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
- CVE-2022-24254High
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- CVE-2022-24252High
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
- CVE-2022-24251High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
Original NVD description (English source)
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet.