CVE-2022-24633

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-24 · updated 2026-06-17
Weakness: CWE-200

Description

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.

Affected products

FileCloud: before 21.3.0.18447 — fixed in 21.3.0.18447

How to fix

Upgrade to a fixed version: FileCloud 21.3.0.18447. Check the vendor advisory for mitigations.

References

https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-1+User+enumeration+vulnerability
https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-1+User+enumeration+vulnerability

Get alerted when CVE-2022-24633 or the next vulnerability affects your stack