Path traversal in VeraCore - CVE-2024-57968
Published: February 5, 2025 / Updated: March 2, 2026
Vulnerability identifier: #VU103655
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-57968
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to upload files to arbitrary folders on the system.
The vulnerability exists due to input validation error when processing file uploads in /VeraCore/OMS/upload.aspx. A remote authenticated user can send a specially crafted HTTP POST request and upload files to an arbitrary location on the system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
VeraCore
How to mitigate CVE-2024-57968
Install updates from vendor's website.
VeraCore - update to 2024.4.2.1