SimpleHelp Missing Authorization Vulnerability

概要

参考情報

• simple-help.com/kb---security-vulnerabilities-01-2025 · Release Notes
• horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations · Technical Description
• trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce · Third Party Advisory
• CISA KEV · CVE-2024-57726

simplehelp のその他の脆弱性

• CVE-2026-48558緊急 10.0悪用確認済み（CISA KEV）SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication …
• CVE-2025-36728高 8.8Cross-Site Request Forgery (CSRF) vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.11.
• CVE-2025-36727高 8.8Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12.
• CVE-2024-57728高 7.2悪用確認済み（CISA KEV）SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a…
• CVE-2024-57727高 7.5悪用確認済み（CISA KEV）SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re…