PT-2019-9522 · Newgen · Newgen Omniflow Intelligent Business Process Suite

Published 2019-08-21 · Updated 2020-08-24 · CVE-2018-17791

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Newgen OmniFlow Intelligent Business Process Suite (iBPS) version 7.0

Description The issue arises from improper server-side validation, allowing client-side validations to be tampered with. This enables inappropriate information to be stored on the server and fetched every time a user visits, potentially causing business confusion. In severe cases, the exploitation can lead to the consumption of all available resources while processing the data, resulting in the unavailability of the service to legitimate users. This vulnerability is exploited by manually editing a disabled form field within the developer options, which allows non-editable parameters to be modified.

Recommendations For Newgen OmniFlow Intelligent Business Process Suite (iBPS) version 7.0, consider restricting access to the developer options to prevent manual editing of disabled form fields until a proper fix is implemented. Additionally, as a temporary workaround, monitor server resource consumption closely to mitigate the risk of service unavailability due to excessive data processing.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2018-17791

Affected Products

Newgen Omniflow Intelligent Business Process Suite

References · 4

• https://osv.dev/vulnerability/CVE-2018-17791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17791 · Security Note
• https://packetstormsecurity.com/files/cve/CVE-2018-17791 · Note
• http://packetstormsecurity.com/files/154061/OmniDoc-7.0-Input-Validation.html · Note