Lucene search

[email protected]NVD:CVE-2023-46595

HistoryNov 02, 2023 - 8:15 a.m.

CVE-2023-46595

2023-11-0208:15:08

CWE-79

[email protected]

web.nvd.nist.gov

html injection

fireflow visualflow

domain credentials

net-ntlm hash

relay domain attacks

a32.20

a32.50

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above), A32.50 (b390 or above)

Affected configurations

NVD

Node

algosecfireflowMatcha32.20

algosecfireflowMatcha32.50

algosecfireflowMatcha32.60

References

cwe.mitre.org/data/definitions/79.html