peter bassill · operator
$ cve CVE-2024-23692 JSON

CVE-2024-23692 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 99.5% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2024-07-30.

Description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS99.49% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-1336
On CISA KEVyes — remediate by 2024-07-30
Public exploityes
Published2024-05-31
Last modified2026-08-11

CISA KEV

NameRejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Added2024-07-09
Due2024-07-30
Vendor / productRejetto / HTTP File Server
Ransomware useknown

Affected (1)

VendorProduct
rejettohttp file server

Public exploits

SourceTitleDate
exploit-dbRejetto HTTP File Server 2.3m - Remote Code Execution (RCE)2025-03-28

References

→ the Explorer  ·  watch your stack  ·  NVD