Unrestricted File Upload Vulnerability in Advantive VeraCore

What changed

Advantive has identified an unrestricted file upload vulnerability in its VeraCore product, affecting versions prior to 2024.4.2.1. This flaw enables remote authenticated users to upload files to unintended directories, which may be accessible to other users during web browsing.

The vulnerability is associated with the 'upload.aspx' functionality, which does not properly restrict file uploads, leading to potential data exposure.

Who is affected

The vulnerability impacts users of Advantive VeraCore, particularly those who have not yet upgraded to the latest version. Organizations utilizing this software should be aware of the risks associated with this flaw.

Remote authenticated users who have access to the upload functionality are also at risk, as they can exploit this vulnerability to upload malicious files.

• Advantive VeraCore users prior to version 2024.4.2.1
• Organizations relying on Advantive for enterprise resource planning
• Remote authenticated users with access to the upload feature

What to do

It is crucial for organizations using Advantive VeraCore to take immediate action to mitigate the risks associated with this vulnerability. Upgrading to version 2024.4.2.1 or later is strongly recommended to eliminate the exposure.

Additionally, organizations should review their user access controls and file upload policies to prevent unauthorized file uploads and to ensure that sensitive data is adequately protected.

• Upgrade Advantive VeraCore to version 2024.4.2.1 or later
• Review and tighten access controls for remote authenticated users
• Implement file upload restrictions to prevent unauthorized access