Description

SimpleHelp has a path traversal vulnerability. This flaw arises from insufficient validation of user-supplied input, allowing unauthenticated attackers to craft HTTP requests that traverse directories and access arbitrary files on the server. Exploitation of this vulnerability can lead to unauthorized exposure of sensitive information, including server configuration files and hashed user passwords, potentially compromising the the system.

Remediation

Upgrade to the latest version of SimpleHelp.

References

SimpleHelp Security Vulnerabilities Advisory

Horizon3.ai Analysis of SimpleHelp Vulnerabilities

Related Vulnerabilities

IBM RTC Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-4946)

MySQL CVE-2018-2761 Vulnerability (CVE-2018-2761)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-5342)

Squid Other Vulnerability (CVE-2010-3072)

PleskWin URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-24044)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal Information Disclosure Known Vulnerabilities CWE-22 CVE-2024-57727 CVE-2024-57726 CVE-2024-57728