Detections
Analytics
Security Updates for SimpleHelp < 5.5.8
critical Nessus Plugin ID 233191
Synopsis
The SimpleHelp is affected by multiple vulnerabilities.Description
The version of SimpleHelp running on the remote web server is prior to 5.3.9, or 5.4.x prior to 5.4.10 or 5.5.x prior to 5.5.8. It is, therefore, affected by multiple vulnerabilities:- Allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. (CVE-2024-57726)
- Multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords. (CVE-2024-57727)
- Allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. (CVE-2024-57728)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to SimpleHelp version 5.3.9, 5.4.10, 5.5.8 or later to address this issueSee Also
Plugin Details
Severity: Critical
ID: 233191
File Name: simplehelp_cve-2024-57726.nasl
Version: 1.1
Type: remote
Family: Web Servers
Published: 3/21/2025
Updated: 3/21/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.1
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-57726
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability Information
CPE: x-cpe:/a:simplehelp:simplehelp
Required KB Items: installed_sw/SimpleHelp
Patch Publication Date: 1/15/2024
Vulnerability Publication Date: 1/15/2024