Design/Logic Flaw

2022-06-0214:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

CPENameOperatorVersion
aceweb_online_portallt3.5.065

CPE	Name	Operator	Version
	aceweb_online_portal	lt	3.5.065

References

aceware.com

aceweb.com

www.aceware.com/forum/viewtopic.php?f=7&t=481