{"id":"CVE-2024-57968","published":"2025-02-03T20:15:36Z","modified":"2026-06-17T08:14:20Z","title":"Advantive VeraCore Unrestricted File Upload Vulnerability","vendor":"Advantive","product":"VeraCore","tier":"core","eol":null,"description":{"text":"Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.","provenance":"source","from":"NVD"},"summary":{"text":"Advantive VeraCore before 2024.4.2.1 contains an unrestricted file upload flaw in its upload.aspx functionality, which is classed as unrestricted upload of a file with a dangerous type. An authenticated remote user with low privileges and no user interaction can upload files into unintended folders, including ones reachable by other users through web browsing.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:31Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.32284,"percentile":0.98324,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1 ; https://nvd.nist.gov/vuln/detail/CVE-2024-57968","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-03","exploitedFirstSeen":"2025-02-03","ransomware":false,"evidence":[{"url":"https://intezer.com/blog/research/xe-group-exploiting-zero-days/","date":"2025-02-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-10"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1","tags":["Permissions Required","Product","Release Notes"]},{"url":"https://intezer.com/blog/research/xe-group-exploiting-zero-days/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57968","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"Advantive VeraCore versions prior to 2024.4.2.1 contain an unrestricted file upload flaw that can lead to remote code execution and full system compromise. This attack requires valid credentials for VeraCore.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"primary_impact","evidence":[],"comment":"Advantive VeraCore versions prior to 2024.4.2.1 contain an unrestricted file upload flaw that can lead to remote code execution and full system compromise. This attack requires valid credentials for VeraCore.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-53868","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-53868","exploited":true,"exploitedSince":"2025-03-10","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://intezer.com/blog/research/xe-group-exploiting-zero-days/","https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2025-02-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57968","provenance":"source"},{"date":"2025-02-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://intezer.com/blog/research/xe-group-exploiting-zero-days/","provenance":"source"},{"date":"2025-03-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-53868","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":35},"priority":{"score":65.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 636 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.66,"detail":"percentile 0.9832"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}