Executive brief
Asseco SEE Live 2.0, a platform used for managing customer interactions like emails, SMS, and faxes, contains a security flaw in how it handles file attachments. An attacker can predict the specific web address where files are stored and access them without proper authorization. This could allow an unauthorized person to view sensitive customer communications or potentially execute malicious files on the system, leading to data theft or a full system compromise.
Technical details
An improper access control vulnerability (CWE-284) exists in Asseco SEE Live 2.0 within its communication handling components. The application stores attachments (from emails, SMS, or faxes) in a predictable directory structure using a format based on the date and the MD5 hash of the file content (e.g., /live20files/emailFiles/private/YYYY-MM-DD/MD5.extension). Because these URLs are computable and the application fails to enforce strict authorization checks on these paths, a remote authenticated attacker can bypass intended access restrictions to retrieve or execute files. If an attacker can upload or send a malicious script (like a .php file) that the system then processes as an attachment, they may achieve remote code execution.
Affected products
- Asseco SEE Live 2.0
Timeline
- 2026-03-11: advisory: Initial NVD publication date