PT-2022-16564 · Extensis · Extensis Portfolio

Published 2022-03-01 · Updated 2022-03-09 · CVE-2022-24251

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Extensis Portfolio version 4.0

Description The issue is related to an authenticated unrestricted file upload vulnerability. This vulnerability can be exploited via the Catalog Asset Upload function.

Recommendations For Extensis Portfolio version 4.0, consider disabling the Catalog Asset Upload function until a patch is available to prevent exploitation of the unrestricted file upload vulnerability.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-24251

Affected Products

Extensis Portfolio

References · 6

• 🔥 https://whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24251 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24251 · Vendor Advisory
• http://extensis.com · Note
• http://portfolio.com · Note
• https://t.me/cvenotify/27585 · Telegram Post