SimpleHelp · SimpleHelp
CVE-2024-57728
SimpleHelp Path Traversal Vulnerability
O que é
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
CISA: SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 8 de maio de 2026
Mais falhas exploradas de SimpleHelp
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 29 de jun. de 2026 | Authentication Bypass | SimpleHelp | Crítica 9,5 | 78% |
| 24 de abr. de 2026 | Missing Authorization | SimpleHelp | Crítica 9,9 | 66% |
| 13 de fev. de 2025 | Path Traversal | SimpleHelp | Crítica 9,1 | 97% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.