Skip to main content
Apexward Pulse

Path traversal

SimpleHelp Path Traversal Vulnerability

CVE-2024-57728

What this means

This is rated high severity (7.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Simple Help Simplehelp is in your estate, and treat that as the priority.

Full vendor description

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

Scoring and exploitation

7.2/ 10
CVSS 3.1 base scoreHigh

Exploitable over the network with an administrator-level account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredHighPR:H
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~64.5% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Known
Listed product
SimpleHelp

Weaknesses

CWE-59CWE-22

Affected products ()

  • Simple Help Simplehelp
Show the raw CPE strings (1)
  • cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*

References

5 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • SimpleHelp Path Traversal Vulnerability

    Type Vulnerability

    SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.

    CVE-2024-57728