{"basis":"claimed","id":"CVE-2024-57727","name":"SimpleHelp Path Traversal Vulnerability","vendorProject":"SimpleHelp ","product":"SimpleHelp","publishedAt":"2025-01-15","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-02-13","dueDate":"2025-03-06","ransomware":true},"epss":{"score":0.96833,"percentile":0.99887,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-02-18","daysToRule":34},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.","cwes":["CWE-22"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-02-18","firstIsNew":true,"daysToRule":34,"daysAtMost":null,"freePlan":false,"claims":[{"id":"e3d6dbc0e3f04a1bae7e5eff1b9ad86be8a363a5989469a7f1aad13c7361b717","cve_id":"CVE-2024-57727","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"498fcd81a62a4b5ca943e2de958094d3","rule_name":"SimpleHelp - Auth Bypass - CVE:CVE-2024-57727","change":"new","default_action":"Block","published_on":"2025-02-18","source_url":"https://developers.cloudflare.com/changelog/post/2025-02-18-waf-release/","source_title":"WAF Release - 2025-02-18","excerpt":"SimpleHelp - Auth Bypass - CVE:CVE-2024-57727. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.759Z"},{"id":"ccd9fc6e8ce8ed65c8eb45336b66d1288299cecbe6524aca3520956870f6aff2","cve_id":"CVE-2024-57727","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"6fe90532af50427484a5275c8c2e30fb","rule_name":"SimpleHelp - Auth Bypass - CVE:CVE-2024-57727","change":"updated","default_action":"Block","published_on":"2025-09-29","source_url":"https://developers.cloudflare.com/changelog/post/2025-09-29-waf-release/","source_title":"WAF Release - 2025-09-29","excerpt":"SimpleHelp - Auth Bypass - CVE:CVE-2024-57727. Previous action: Log. New action: Block. This rule is merged to 100717 in legacy WAF and ...958094d3 in new WAF","first_seen_at":"2026-11-02T21:00:15.788Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:42.096Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2024-57727","templatePath":"http/cves/2024/CVE-2024-57727.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110","930130"],"note":"","requestDetail":[{"method":"GET","path":"/toolbox-resource/../serverconfig.xml","status":403,"blocked":true,"rules":["930100","930110","930130"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2024-57727","templatePath":"http/cves/2024/CVE-2024-57727.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110","930130"],"note":"","requestDetail":[{"method":"GET","path":"/toolbox-resource/../serverconfig.xml","status":403,"blocked":true,"rules":["930100","930110","930130"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}