CVE-2024-33881: Virtosoftware SharePoint Bulk File Download

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.

Affected products

• Virtosoftware SharePoint Bulk File Download: version 5.5.44 only

Published 2024-06-24. Last modified 2026-06-17.