VulnerabilityPublished 25 Apr 2018Updated 30 May 2025

CVE-2018-10212: Vaultize Enterprise File Sharing

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 11:07 UTC

Severity

Medium

Rated Medium by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Apr 2018
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected =17.05.31	Fixed in–

AI-suggested

To mitigate this vulnerability, organizations should first verify if they are running the affected version (17.05.31) of Vaultize Enterprise File Sharing and prioritize upgrading to a patched or newer version where the authorization flaw is resolved. If an official patch is unavailable, implementing strict network segmentation and access controls to limit exposure of the Vaultize server is critical. Administrators should audit device and session management logs to detect anomalous folder creation activities and enforce multi-factor authentication to reduce the risk of compromised credentials being used to exploit the flaw. Additionally, reviewing and tightening authorization policies within the application configuration can help prevent unauthorized cross-account actions. Employing application-layer firewalls or intrusion detection systems to monitor and block suspicious API calls or parameter tampering attempts related to device values is recommended. Finally, educating users about potential social engineering risks stemming from unauthorized folder creation can reduce the likelihood of follow-on attacks.

Description

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creation of folders within another account via a modified device value.

Impact

For European organizations, this vulnerability could have several impacts. Enterprises relying on Vaultize for secure file sharing may face risks to data integrity and user trust, as unauthorized folder creation could disrupt workflows and lead to confusion or mismanagement of shared resources. While direct data theft or deletion is not indicated, the ability to manipulate folder structures across accounts could be exploited as a stepping stone for more sophisticated attacks or insider threats. Organizations in regulated sectors such as finance, healthcare, or government could face compliance challenges if unauthorized access leads to data governance violations. Additionally, the presence of this vulnerability could undermine confidence in the security posture of file sharing solutions, potentially affecting collaboration and productivity. The impact is heightened in environments where Vaultize is integrated with other identity and access management systems, as improper authorization may cascade into broader access control issues.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2025, 14:57 UTC

Technical details

References

Community reviews

Related threats