PT-2024-15833 · Arcserve · Arcserve Unified Data Protection

Published 2024-03-13 · Updated 2025-10-14 · CVE-2024-0800

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arcserve Unified Data Protection versions 8.1 through 9.2

Description A path traversal issue exists in the edge-app-base-webui.jar, specifically affecting the ImportNodeServlet function. This issue is present in the mentioned versions of Arcserve Unified Data Protection.

Recommendations For versions 8.1 through 9.2, consider restricting access to the ImportNodeServlet function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-0800

Affected Products

Arcserve Unified Data Protection

References · 12

• 🔥 https://tenable.com/security/research/tra-2024-07 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0800 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0800 · Vendor Advisory
• https://twitter.com/CCBalert/status/1768579319775834571 · Twitter Post
• https://twitter.com/cipherstorm/status/1768270254504067414 · Twitter Post
• https://twitter.com/shah_sheikh/status/1768229653263839686 · Twitter Post
• https://t.me/cveNotify/138604 · Telegram Post
• https://t.me/cvenotify/73739 · Telegram Post
• https://t.me/cvenotify/73787 · Telegram Post
• https://t.me/true_secator/5733 · Telegram Post
• https://twitter.com/CoreSecurity/status/1855997653126980064 · Twitter Post
• https://twitter.com/CCBalert/status/1790001879432233332 · Twitter Post