CVE-2024-23692 Rejetto HTTP File Server 2.3m Unauthenticated RCE

2024-05-3109:36:28

CWE-1336

VulnCheck

github.com

cve-2024-23692

rejetto http file server

template injection

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.956

Percentile

99.5%

SSVC

Exploitation

active

Automatable

yes

Technical Impact

total

JSON

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

CNA Affected

[
  {
    "vendor": "Rejetto",
    "product": "HTTP File Server",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2.3m"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rejetto:http_file_server:2.3m:*:*:*:*:*:*:*"
    ],
    "vendor": "rejetto",
    "product": "http_file_server",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2.3m"
      }
    ],
    "defaultStatus": "unknown"
  }
]