PT-2022-16768 · Filecloud · Filecloud

Published 2022-02-22 · Updated 2022-03-02 · CVE-2022-24633

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileCloud versions prior to 21.3

Description The issue allows for user enumeration. It exists in the path parameter when passing /SHARED/<username>. A malicious actor could identify the existence of users by requesting share information on specified share paths.

Recommendations For versions prior to 21.3, update to version 21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /SHARED/<username> path to minimize the risk of exploitation. Avoid using the path parameter with /SHARED/<username> in the affected API endpoint until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-24633

Affected Products

Filecloud

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-24633 · Security Note
• https://filecloud.com/supportdocs/display/cloud/Advisory+2022-01-1+User+enumeration+vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24633 · Vendor Advisory
• https://t.me/cibsecurity/37989 · Telegram Post