Detections
Analytics

SimpleHelp Unauthenticated Path Traversal

high Web App Scanning Plugin ID 114659

Language:

Synopsis

SimpleHelp Unauthenticated Path Traversal

Description

SimpleHelp versions 5.5.x < 5.5.8, 5.4.x < 5.4.10 and 5.3.x < 5.3.9 suffer from an unauthenticated path traversal vulnerability. By crafting a specific URL, a remote and unauthenticated attacker can access sensitive file such as 'serverconfig.xml' which contains at least the SimpleHelpAdmin user hashed password, and conduct further attack on the remote system.

Solution

Upgrade to SimpleHelp version 5.3.9, 5.4.10, 5.5.8 or later.

See Also

https://simple-help.com/

https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier

https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/

Plugin Details

Severity: High

ID: 114659

Type: remote

Published: 3/12/2025

Updated: 3/12/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 6.1

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-57727

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Score Source: CVE-2024-57727

Vulnerability Information

CPE: cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/8/2025

Vulnerability Publication Date: 1/12/2025

CISA Known Exploited Vulnerability Due Dates: 3/6/2025

Reference Information

CVE: CVE-2024-57727