CVE-2024-1148CWE-287

Weak Access Control - Arbitrary file upload

Critical · published March 21, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

🚨 A sneaky flaw in OpenText PVCS Version Manager lets attackers slip past authentication and upload files without a hitch!🔥 Think of it like a hotel that forgot to check IDs at the front desk — anyone could walk in and drop off anything they want in any room without a second glance. This could lead to unauthorized users uploading malicious files, effectively giving them a foothold in your system. Even worse, if sensitive data is exposed or compromised, it could lead to devastating repercussions for your organization, including data breaches and loss of trust from your clients.

Put simply

Think of it like a hotel that forgot to check IDs at the front desk — anyone could walk in and drop off anything they want in any room without a second glance. The weakness in access control allows potential bypassing of authentication mechanisms, enabling unauthorized file uploads by exploiting insufficient checks within the application.

What to do

This could lead to unauthorized users uploading malicious files, effectively giving them a foothold in your system. Even worse, if sensitive data is exposed or compromised, it could lead to devastating repercussions for your organization, including data breaches and loss of trust from your clients. Immediately patch to the latest version of OpenText PVCS Version Manager. Conduct a thorough review of access controls and audit any uploaded files for unauthorized changes or suspicious content. You’ve got this! Follow these steps to lock down your system and keep those sneaky attackers out! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-03-21T07:34Z
EPSS history
Timeline
  • 21 MAR 07:34Z
    Weak Access Control - Arbitrary file upload
    cvelistv5