CVE-2025-57727: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2024-57727 affects SimpleHelp remote support software versions 5.5.7 and earlier. The vulnerability was discovered in January 2025 and was added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on February 13, 2025. This security flaw enables unauthenticated remote attackers to download arbitrary files from the SimpleHelp host through crafted HTTP requests (MITRE).

The vulnerability is classified as a path traversal vulnerability (CWE-22) that allows unauthorized access to sensitive files. It received a CVSS v3.1 base score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction. CISA-ADP later assessed it with a higher CVSS score of 9.1 (Critical) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (MITRE).

The vulnerability enables attackers to access server configuration files containing various secrets and hashed user passwords. This access could lead to unauthorized disclosure of sensitive information and potential system compromise (MITRE).

CISA requires federal agencies to apply vendor mitigations or discontinue product use if mitigations are unavailable. Organizations should upgrade to versions newer than 5.5.7 to address this vulnerability (MITRE).