CVE-2024-33881: Path Traversal
Published Jun 24, 2024
·Updated
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.
Affected Software
2 affected components
All of the following
VirtoSoftware Sharepoint Bulk File Download=5.5.44
Microsoft SharePoint Server=2019
Event History
Jun 24, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-33881?
CVE-2024-33881 has a high severity level due to the potential for NTLMv2 hash leakage.
2
How do I fix CVE-2024-33881?
To fix CVE-2024-33881, you should update to the latest patched version of Virto Bulk File Download.
3
What is the impact of CVE-2024-33881?
The impact of CVE-2024-33881 includes unauthorized access to sensitive authentication tokens through a leak.
4
Who is affected by CVE-2024-33881?
CVE-2024-33881 affects users of VirtoSoftware Virto Bulk File Download version 5.5.44 running on SharePoint 2019.
5
Is CVE-2024-33881 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2024-33881 in the wild.