SimpleHelp · SimpleHelp
CVE-2024-57728
SimpleHelp Path Traversal Vulnerability
De quoi s'agit-il
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
CISA: SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Que faire
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Échéance pour les agences fédérales américaines : 8 mai 2026
Autres failles exploitées chez SimpleHelp
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 29 juin 2026 | Authentication Bypass | SimpleHelp | Critique 9,5 | 78% |
| 24 avr. 2026 | Missing Authorization | SimpleHelp | Critique 9,9 | 66% |
| 13 févr. 2025 | Path Traversal | SimpleHelp | Critique 9,1 | 97% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.