CVE-2022-24633 Information disclosure in n/a
Attackers can enumerate valid usernames in FileCloud by exploiting a path parameter, potentially aiding further targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24633?
CVE-2022-24633 is a medium-severity vulnerability in n/a, published on 22 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.
Weakness: CWE-200
Which versions are affected by CVE-2022-24633?
It affects 1 product.
Products include Filecloud Filecloud.
How do I fix CVE-2022-24633?
No fix has been published for CVE-2022-24633 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-24633 being exploited?
There is no known exploitation of CVE-2022-24633 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2gqp-7qqf-5rcq.