CVE-2024-33881: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Restrict network access to the Virto.SharePoint.FileDownloader/Api/Download.ashx endpoint by implementing firewall rules or network segmentation to limit exposure to trusted internal users only. 2. Monitor network traffic for unusual SMB/UNC connection attempts originating from the SharePoint server, which may indicate exploitation attempts. 3. Disable or restrict the use of UNC paths in the path parameter if possible through configuration or custom request validation. 4. Employ strong SMB signing and encryption policies to reduce the risk of NTLM relay attacks. 5. Enforce the use of more secure authentication protocols such as Kerberos instead of NTLM where feasible. 6. Regularly audit and monitor authentication logs for suspicious NTLM authentication attempts or anomalies. 7. Apply principle of least privilege to service accounts and users interacting with the SharePoint environment to limit potential damage from compromised credentials. 8. Stay alert for official patches or updates from VirtoSoftware and apply them promptly once released. 9. Consider deploying endpoint detection and response (EDR) solutions to detect lateral movement or credential theft activities. 10. Educate IT and security teams about this vulnerability and the risks associated with NTLM hash leakage to improve incident response readiness.
Description
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.