CVE-2022-24581 Information

Description

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

Reference

http://aceware.com http://aceweb.com https://www.aceware.com/forum/viewtopic.php?f=7&t=481