Fortra Releases Update on Critical Severity RCE Flaw
The flaw has a CVSS rating of 9.8, and the company recommends product upgrades to fix the issue.
![A bunch of binary code in red, orange, and blue A bunch of binary code in red, orange, and blue](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd6b4f91f19eae5bd/64f175d690b1dc2bd4fe601a/vulnerability-ktdesign-AdobeStock.jpeg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Fortra this week released an update for a critical vulnerability that was initially discovered in August 2023.
Tracked as CVE-2024-25153 with a critical severity CVSS score of 9.8, the vulnerability poses a threat to the company's FileCatalyst file transfer product. It's a type of software that allows for "the transfer of large files over remote networks experiencing high latency or packet loss," according to the company.
The vulnerability can be exploited if an unauthenticated threat actor executes arbitrary code remotely on affected servers.
"A directory traversal within the 'ftpservlet' of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended 'uploadtemp' directory with a specially crafted POST request," Fortra said in its advisory. "In situations where a file is successfully uploaded to web portal's DocumentRoot, specially crafted JSP files could be used to execute code, including web shells."
Though Fortra has been aware of the bug since it was initially reported months ago, it is issuing a CVE now at the request of the individual who reported the vulnerability in the first place.
Fortra reports that products that are affected by this bug are its Fortra FileCatalyst Workflow 5.x software, and it recommends upgrading to the 5.1.6 Build 114 or higher to remediate the issue.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024