Actively exploited in the wild

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto - HTTP File Server · Listed in the CISA KEV since 2024-07-09. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2024-23692

CriticalCVSS 9.8KEV

Published: 31/05/2024(UTC)Updated: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.47%

100th percentile - higher than 100% of all known CVEs

Summary

Rejetto HTTP File Server up to version 2.3m is vulnerable to template injection. A remote, unauthenticated attacker can execute arbitrary commands on the system by sending a specially crafted HTTP request. Version 2.3m is no longer supported.

Risk Assessment

An attacker can gain full control of the server, leading to compromise of confidentiality, integrity, and availability of data and services.

Recommendation

Upgrade to a supported version or replace the software, as version 2.3m will not receive fixes.

Original NVD description (English source)

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.