CVE-2022-24255
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
Risk Assessment
An attacker can gain full control over the system, leading to a breach of data confidentiality, integrity, and availability.
Recommendation
Immediately change the default credentials and update the software to the latest version if available.
Other vulnerabilities in Extensis Portfolio
See all- CVE-2022-24254High
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
- CVE-2022-24253High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
- CVE-2022-24252High
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
- CVE-2022-24251High
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
Original NVD description (English source)
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.