CVE-2024-57727SimpleHelp Path Traversal Vulnerability
Aktif olarak istismar ediliyor — SimpleHelp Path Traversal Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 13.02.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 06.03.2025.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://simple-help.com/kb---security-vulnerabilities-01-2025 ; Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ; https://nvd.nist.gov/vuln/detail/CVE-2024-57727
Açıklama
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| simple-help | simplehelp | < 5.5.8 |
Kaynaklar ve yamalar
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/ Third Party Advisory
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-an… Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*< 5.5.8