CVE-2024-57968: Malicious File Upload
First published: Mon Feb 03 2025(Updated: )
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VeraCore | <2024.4.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1
- https://intezer.com/blog/research/xe-group-exploiting-zero-days/
- https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
- https://www.darkreading.com/cyber-risk/xe-group-shifts-card-skimming-supply-chain-attacks
Frequently Asked Questions
What is the severity of CVE-2024-57968?
CVE-2024-57968 is considered a medium severity vulnerability due to its potential for file upload exploitation.
How do I fix CVE-2024-57968?
To fix CVE-2024-57968, upgrade Advantive VeraCore to version 2024.4.2.1 or later.
Who is affected by CVE-2024-57968?
Remote authenticated users of Advantive VeraCore versions prior to 2024.4.2.1 are affected by CVE-2024-57968.
What type of vulnerability is CVE-2024-57968?
CVE-2024-57968 is a directory traversal vulnerability that allows unintended file uploads.
What are the consequences of CVE-2024-57968?
The consequences of CVE-2024-57968 include unauthorized file access and potential exposure of sensitive data.
- agent/author
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- collector/darkreading
- source/Dark Reading
- alias/CVE-2017-9248
- alias/CVE-2024-57968
- alias/CVE-2025-25181
- agent/severity
- agent/source
- agent/references
- agent/weakness
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/news-ai
- zeroday/true
- vendor/advantive
- canonical/veracore