PortfolioDAM Help

What’s New in Portfolio 4.0.1

  • Server: We updated Apache Tomcat to version 9.0.58.

  • Server: We updated the log4j library to version 2.17.2. This eliminates a vulnerability introduced in earlier versions of the log4j library as detailed here: https://www.cve.org/CVERecord?id=CVE-2021-44228.

  • We addressed five high-risk flaws identified by White Oak Security:

    • Admin/Web/Desktop: Authentication Bypass – Hard-Coded Credentials (CVE-2022-24255)

    • Web: Authenticated Unrestricted File Upload Resulting in Remote Code Execution (CVE-2022-24251)

    • Web: Authenticated Unrestricted File Upload + Path Traversal Resulting in Remote Code Execution (CVE-2022-24252)

    • Admin: Authenticated Archive Zip-Slip Path Traversal Resulting in Remote Code Execution (CVE-2022-24254)

    • Admin: Authenticated Unrestricted File Upload Resulting in Remote Code Execution (CVE-2022-24253)