HackZoneLabs News
Newsletter

CVE-2024-23692

Rejetto HTTP File Server 2.3m Unauthenticated RCE

  • Critical 9.8
  • Exploited: added to CISA KEV 9 Jul 2024
  • Used in ransomware campaigns

Description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Key facts

Published
31 May 2024
Last changed
8 Nov 2026
Assigned by
VulnCheck
KEV added
9 Jul 2024
KEV fix due
30 Jul 2024
Used in ransomware
Yes, according to CISA
EPSS
99.485% likely to be exploited in the next 30 days, higher than 99.944% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 9.8CVSS 3.1, Criticalfrom the CNA (VulnCheck)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

  • Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-242 Code Injection (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
RejettoHTTP File Server
  • Default status: unaffected
  • 0 up to and including 2.3m (affected)

Timeline

  1. 31 May 2024 Published
  2. 9 Jul 2024 CVE-2024-23692 added to CISA KEV
  3. 9 Jul 2024 Added to the CISA KEV catalogue

Weakness

References