CVE-2024-57727

HIGHCISA KEV

7.5

Descripcion

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado1/15/2025

Ultima modificacion11/4/2025

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorSimpleHelp

ProductoSimpleHelp

Nombre vulnerabilidadSimpleHelp Path Traversal Vulnerability

Fecha inclusion KEV2025-02-13

Fecha limite remediacion2025-03-06

Uso en ransomwareKnown

Productos afectados

simple-help:simplehelp

Debilidades (CWE)

CWE-22CWE-22

Referencias

https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier(cve@mitre.org)

https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/(cve@mitre.org)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.