CVE-2022-24254
HighCVSS 8.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
Risk Assessment
An attacker can take over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update Extensis Portfolio to the latest version and implement file upload validation mechanisms, including checking ZIP file types and contents.
Other vulnerabilities in Extensis Portfolio
See all- CVE-2022-24255High
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
- CVE-2022-24253High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
- CVE-2022-24252High
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
- CVE-2022-24251High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
Original NVD description (English source)
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.