CVE-2024-23692
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jul 9, 2024
- US federal agencies must remediate it by Jul 30, 2024 (BOD 22-01)
- First attack observed 28 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 28, 2026 Sep 27, 2026
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-1336, CWE-94
Vendorsrejetto
Affected products
| Vendors | Product | Versions |
|---|---|---|
| rejetto | http file server | <= 2.4 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.