PT-2025-5986 · Gleamtech · Gleamtech Filevista

Published 2025-02-07 · Updated 2025-02-07 · CVE-2024-57249

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gleamtech FileVista version 9.2.0.0

Description The issue is related to incorrect access control in the preview function, allowing remote attackers to gain unauthorized access by exploiting a vulnerability in access control mechanisms. This is achieved by removing authentication-related HTTP headers, such as the Cookie header, in the request, which bypasses the authentication process. As a result, attackers can access sensitive image files without proper login credentials.

Recommendations For Gleamtech FileVista version 9.2.0.0, consider disabling the preview function until a patch is available to prevent unauthorized access to sensitive image files. Restrict access to the vulnerable preview module to minimize the risk of exploitation. Avoid using the Cookie header in requests to the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-57249

Affected Products

Gleamtech Filevista

References · 7

• 🔥 https://packetstorm.news/files/id/189019 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57249 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57249 · Vendor Advisory
• https://twitter.com/CVEnew/status/1887886673125449936 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887928891706085582 · Twitter Post
• https://t.me/cvedetector/17497 · Telegram Post
• https://gleamtech.com/filevista · Note