CVE-2024-57968: critical vulnerability in Advantive VeraCore
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Advantive VeraCore versions before 2024.4.2.1 allow logged-in users to upload files to any folder on the server, including those visible to other users on the web. This means attackers with access can place malicious files where others can find and potentially execute them.
A path traversal vulnerability in upload.aspx permits authenticated users to specify arbitrary upload directories during file submission. An attacker with valid credentials can upload files outside intended storage locations, potentially reaching web-accessible directories to execute arbitrary code or distribute malware to other users.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.