PT-2022-16556 · Unknown · Aceweb Online Portal

Published 2022-05-27 · Updated 2022-06-11 · CVE-2022-24239

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065

Description The ACEweb Online Portal contains an issue that allows for unrestricted file upload via the attachments.awp endpoint.

Recommendations For ACEweb Online Portal version 3.5.065, consider restricting access to the attachments.awp endpoint until a patch is available. As a temporary workaround, disabling the file upload functionality via attachments.awp can help minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-24239

Affected Products

Aceweb Online Portal

References · 5

• https://osv.dev/vulnerability/CVE-2022-24239 · Vendor Advisory
• https://aceware.com/forum/viewtopic.php?f=7&t=481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24239 · Security Note
• http://aceweb.com · Note
• http://aceware.com · Note