High severity · published Feb 3, 2025
CVE-2024-57968
Advantive VeraCore Unrestricted File Upload Vulnerability
In wildKEV
8.8
CVSS
32.3%
EPSS
Yes
On KEV
Description
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)32.3% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 10, 2025
Federal remediation dueMar 31, 2025
Ransomware campaign useNot known
Affected products
Which versions
VE
VeraCore · Advantive
before 2024.4.2.1 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-57968
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-57968
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
advantive.my.site.com
https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1
intezer.com
https://intezer.com/blog/research/xe-group-exploiting-zero-days/
www.solissecurity.com
https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
More from VeraCore
7.5
CVE-2025-25181
Advantive VeraCore SQL Injection Vulnerability