PT-2004-2537 · Open Workflow Engine · Openwfe

Jose Antonio Coret + 1 · Published 2004-10-25 · Updated 2017-07-11 · CVE-2004-1631

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WorkFlow Engine (OpenWFE) versions 1.4.x

Description The issue allows remote attackers to conduct port scans of remote hosts. This is achieved by specifying the target in an "rmi:// Worklist URL", then using the response times to infer the results.

Recommendations For OpenWFE versions 1.4.x, consider restricting access to the rmi:// Worklist URL to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1631

Affected Products

Openwfe

References · 5

• http://secunia.com/advisories/12970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1631 · Security Note
• http://securityfocus.com/bid/11514 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109876304705234&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17852 · Note