Security readout for executives and security teams
Plain-English summary
Extensis Portfolio v4.0 has a backup/restore file-upload flaw that can let a remote attacker run code by submitting a crafted ZIP archive. That means a vulnerable server could move from a file-handling bug to full system compromise. The public bundle does not provide CVSS scoring or a named fixed version.
Executive priority
Treat this as a high-priority exposure review because the described impact is remote arbitrary code execution. Prioritize internet-facing or broadly reachable Portfolio systems first. Urgency should be tempered by the incomplete public metadata and lack of KEV evidence in the supplied bundle.
Technical view
The issue is an unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0. The CVE description says remote attackers can execute arbitrary code through a crafted ZIP file. The linked Snyk reference describes the Zip Slip vulnerability class; the bundle does not include detailed affected CPEs, CVSS, or patch metadata.
Likely exposure
Exposure is most likely where Extensis Portfolio v4.0 is deployed and the Backup/Restore Archive component is reachable by remote users or untrusted networks. The source bundle lists affected vendor/product as n/a, so confirm product/version details locally rather than relying on CPE matching.
Exploitation context
The provided sources do not indicate CISA KEV status or active exploitation. The CVE description supports remote code execution through a crafted ZIP file, but the bundle does not establish whether authentication, specific privileges, or network placement are required.
Researcher notes
Evidence is limited to the CVE description and two public references. The vulnerability appears related to unsafe ZIP archive handling in a backup/restore workflow, consistent with Zip Slip-style risk. Do not assume affected versions beyond Extensis Portfolio v4.0 without vendor confirmation.
Mitigation direction
- Check Extensis vendor guidance for fixed versions or supported remediation.
- Restrict network access to the Backup/Restore Archive component immediately.
- Disable backup/restore archive upload functionality if business operations allow.
- Limit access to trusted administrators until remediation is confirmed.
- Monitor Portfolio servers for unusual archive upload or restore activity.
Validation and detection
- Inventory Extensis Portfolio deployments and identify any v4.0 instances.
- Confirm whether the Backup/Restore Archive component is enabled and reachable.
- Review access controls around backup and restore workflows.
- Check server logs for suspicious ZIP upload or restore events.
- Verify vendor advisory status and documented fixed versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-24254 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/research/zip-slip-vulnerabilityCVE reference, mitre
- https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.