// For flags

CVE-2022-24581

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

ACEweb Online Portal versión 3.5.065, permite una captura de hash SMB no autenticada por medio de UNC. Al especificar la ruta de archivo UNC de un recurso compartido SMB externo cuando es cargado un archivo, un atacante puede inducir al servidor víctima a revelar el hash del nombre de usuario y la contraseña del usuario que ejecuta el software ACEweb Online

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-07 CVE Reserved
  • 2022-05-27 CVE Published
  • 2024-08-03 CVE Updated
  • 2025-02-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Aceware
Search vendor "Aceware"
 Aceweb Online Portal
Search vendor "Aceware" for product "Aceweb Online Portal"
 < 3.5.065
Search vendor "Aceware" for product "Aceweb Online Portal" and version " < 3.5.065"
-
Affected