CVE-2022-24581
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability in ACEweb Online Portal 3.5.065 allows an unauthenticated attacker to capture SMB hashes by specifying an external UNC path when uploading a file. The attacker can trick the victim server into disclosing the username and password hash of the user running the ACEweb Online software.
Risk Assessment
The risk involves potential theft of authentication credentials (NTLM hashes) of the server user, which could lead to unauthorized access to other systems within the organization's internal network.
Recommendation
Immediately update ACEweb Online Portal to the latest patched version. As a workaround, block outbound SMB connections (port 445) from the server to external networks and enforce the principle of least privilege.
Other vulnerabilities in ACEweb Online Portal
See all- CVE-2022-24240Critical
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2022-24239Critical
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
- CVE-2022-24241High
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
- CVE-2022-24238Medium
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.