CVE-2024-39776
Avtecinc Outpost Uploader Utility ≤ 5.0.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-39776 is a high-severity Storage of File with Sensitive Data Under Web Root (CWE-219) vulnerability in Avtecinc Outpost Uploader Utility. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38234
Vulnerability Data
Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.4
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces logical access authorizations on resources, stopping unauthorized parties from reaching sensitive files stored under the web root.
AC-6 limits granted privileges to the minimum needed, reducing the chance that web-accessible paths expose sensitive data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege access permissions directly prevents unauthorized retrieval of sensitive files stored under the web root.
Protecting confidentiality of data-at-rest mitigates exposure of files that should never have been placed under the web root.
Hardened configuration baselines and change control prevent placement of sensitive files in publicly served directories.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage storing sensitive data in publicly served directories.
Technical access restrictions can block direct HTTP access to sensitive files under the web root.
Classification identifies sensitive data so it can be placed outside the web root.
Access-control policy defines who may reach files under the web root.
Granting only the minimum rights prevents unauthorized retrieval of sensitive files.
Secure SDLC practices include placing sensitive data outside the document root.