Riskcovery

CVE-2024-5276

SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

State
Published
Severity
9.8 Critical
Published
Jun 25, 2024
Updated
Aug 1, 2024
Reserved
May 23, 2024

Read the record on cve.org

Description

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFortra

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
FileCatalyst WorkflowFortra
  • 5.1.6; 0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.