1. Home
  2. CVE Database
  3. CVE-2022-24581
HIGH · 7.5

CVE-2022-24581

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server t...

Vulnerability Description

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
AcewareAceweb Online Portal< 3.5.065

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2022-24581?

CVE-2022-24581 is a vulnerability with a CVSS score of 7.5 (HIGH). ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server t...

How severe is CVE-2022-24581?

CVE-2022-24581 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-24581?

Check the references section above for vendor advisories and patch information. Affected products include: Aceware Aceweb Online Portal.