PT-2022-24692 · Unknown · Agentflow Bpm

Alan Chung + 1 · Published 2022-11-10 · Updated 2022-11-15 · CVE-2022-39038

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Agentflow BPM enterprise management system (affected versions not specified)

Description The issue is related to improper authentication in the Agentflow BPM enterprise management system. A remote attacker with general user privilege can exploit this by changing the name of the user account to acquire arbitrary account privilege. This allows the attacker to access, manipulate the system, or disrupt the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-39038

Affected Products

Agentflow Bpm

References · 7

• https://flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39038 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39038 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-6684-53149-1.html · Note
• https://t.me/cvenotify/37777 · Telegram Post
• https://t.me/cibsecurity/52910 · Telegram Post
• https://t.me/cvenotify/37490 · Telegram Post