PT-2022-16734 · Unknown · Aceweb Online Portal

Published 2022-05-27 · Updated 2022-06-11 · CVE-2022-24581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065

Description The issue allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

Recommendations For ACEweb Online Portal version 3.5.065, consider restricting access to the file upload functionality until a patch is available. As a temporary workaround, avoid using the UNC file path of an external SMB share when uploading files to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-24581

Affected Products

Aceweb Online Portal

References · 5

• https://osv.dev/vulnerability/CVE-2022-24581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24581 · Security Note
• https://aceware.com/forum/viewtopic.php?f=7&t=481 · Vendor Advisory
• http://aceweb.com · Note
• http://aceware.com · Note