Wiz Agents & Workflows are here
Wiz
Vulnerability DatabaseCVE-2024-1226

CVE-2024-1226: 
Rejetto HFS vulnerability analysis and mitigation

Overview

A high-severity vulnerability (CVE-2024-1226) has been identified in Rejetto Http File Server (HFS) version 2.2a build #124. The vulnerability was discovered by Rafael Pedrero and has been assigned a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) (INCIBE Notice).

Technical details

The vulnerability stems from the software's failure to properly neutralize certain characters before including them in outgoing HTTP headers. This security flaw is categorized as CWE-93, allowing attackers to specify the full HTTP response represented by the browser (INCIBE Notice).

Impact

The vulnerability enables attackers to control the HTTP response, potentially leading to cross-site scripting attacks and cache poisoning attacks (INCIBE Notice).

Mitigation and workarounds

The vulnerability has been addressed in subsequent versions of the software. However, it should be noted that the affected version (2.2a build #124) is no longer supported (INCIBE Notice).

Additional resources

Source: This report was generated using AI

Related Rejetto HFS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2024-23692CRITICAL9.8
  • Rejetto HFSRejetto HFS
  • cpe:2.3:a:rejetto:http_file_server
YesYesMay 31, 2024
CVE-2024-39943HIGH8.8
  • JavaScriptJavaScript
  • hfs
NoYesJul 04, 2024
CVE-2024-1226HIGH7.5
  • Rejetto HFSRejetto HFS
  • cpe:2.3:a:rejetto:http_file_server
NoYesMar 12, 2024
CVE-2020-13432HIGH7.5
  • Rejetto HFSRejetto HFS
  • cpe:2.3:a:rejetto:http_file_server
NoYesJun 08, 2020
CVE-2024-1227MEDIUM6.5
  • Rejetto HFSRejetto HFS
  • cpe:2.3:a:rejetto:http_file_server
NoYesMar 12, 2024

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo