PT-2022-24690 · Unknown · Agentflow Bpm

Alan Chung + 1 · Published 2022-11-10 · Updated 2022-11-15 · CVE-2022-39036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Agentflow BPM (affected versions not specified)

Description The file upload function has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this to upload arbitrary files and execute arbitrary code, potentially manipulating the system or disrupting the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-39036

Affected Products

Agentflow Bpm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-39036 · Security Note
• https://flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39036 · Vendor Advisory
• https://t.me/cvenotify/37771 · Telegram Post
• https://t.me/cibsecurity/52921 · Telegram Post
• https://t.me/cvenotify/37492 · Telegram Post
• https://twcert.org.tw/tw/cp-132-6682-21207-1.html · Note