PT-2023-30106 · Fireflow · Fireflow

Michał Bogdanowicz · Publicado 2023-11-02 · Atualizado 2025-11-12 · CVE-2023-46595

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FireFlow versions prior to A32.20 (b570) FireFlow versions prior to A32.50 (b390) FireFlow versions prior to A32.60 (b220)

Description The issue allows an attacker to obtain a victim's domain credentials and Net-NTLM hash via HTML injection in the VisualFlow workflow editor, potentially leading to relay domain attacks. This is achieved through stored HTML injection using the Name and Description fields, and also impacts outbound actions using the Name and Category parameters.

Recommendations For versions prior to A32.20 (b570), update to A32.20 (b570 or above) to resolve the issue. For versions prior to A32.50 (b390), update to A32.50 (b390 or above) to resolve the issue. For versions prior to A32.60 (b220), update to A32.60 (b220 or above) to resolve the issue. As a temporary workaround, consider restricting the use of the Name and Description fields in the VisualFlow workflow editor, as well as limiting outbound actions using the Name and Category parameters, until a patch is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46595

Produtos afetados

Fireflow

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-46595 · Nota de Segurança
• https://t.me/cvenotify/60353 · Publicação no Telegram
• https://t.me/cvenotify/61320 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46595 · Aviso do Fabricante
• https://cwe.mitre.org/data/definitions/79.html · Nota
• https://t.me/cveNotify/142497 · Publicação no Telegram
• https://t.me/cibsecurity/73417 · Publicação no Telegram