Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

The version of Rejetto HTTP File Server installed on the remote host is 2.x up to 2.3m. It is, therefore, affected by a vulnerability:

  - Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection     vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands     on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto     HFS 2.3m is no longer supported. (CVE-2024-23692)

The version of Rejetto HTTP File Server installed on the remote host is 2.x up to 2.3m. It is, therefore, affected by a vulnerability:

  - Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection     vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands     on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto     HFS 2.3m is no longer supported. (CVE-2024-23692)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Rejetto HTTP File Server 2.x, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

ID	Name	Product	Family	Severity
211465	Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692) (direct check)	Nessus	Web Servers	critical
206652	Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692)	Nessus	Web Servers	critical
114299	Rejetto HTTP File Server 2.x Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-23692

critical

Tenable Plugins

critical

critical

critical