Lucene search

FortraCVELIST:CVE-2024-6632

HistoryAug 27, 2024 - 2:12 p.m.

CVE-2024-6632 SQL Injection in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)

2024-08-2714:12:12

CWE-89

Fortra

www.cve.org

cve-2024-6632

sql injection

filecatalyst workflow

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

20.0%

JSON

A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FileCatalyst Workflow",
    "vendor": "Fortra",
    "versions": [
      {
        "lessThanOrEqual": "5.1.6 Build 139",
        "status": "affected",
        "version": "5.0.4",
        "versionType": "semver"
      }
    ]
  }
]

References

www.fortra.com/security/advisories/product-security/fi-2024-010

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

20.0%

JSON

Related for CVELIST:CVE-2024-6632