PT-2023-30106 · Fireflow · Fireflow

Michał Bogdanowicz · Published 2023-11-02 · Updated 2025-11-12 · CVE-2023-46595

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FireFlow versions prior to A32.20 (b570) FireFlow versions prior to A32.50 (b390) FireFlow versions prior to A32.60 (b220)

Description The issue allows an attacker to obtain a victim's domain credentials and Net-NTLM hash via HTML injection in the VisualFlow workflow editor, potentially leading to relay domain attacks. This is achieved through stored HTML injection using the Name and Description fields, and also impacts outbound actions using the Name and Category parameters.

Recommendations For versions prior to A32.20 (b570), update to A32.20 (b570 or above) to resolve the issue. For versions prior to A32.50 (b390), update to A32.50 (b390 or above) to resolve the issue. For versions prior to A32.60 (b220), update to A32.60 (b220 or above) to resolve the issue. As a temporary workaround, consider restricting the use of the Name and Description fields in the VisualFlow workflow editor, as well as limiting outbound actions using the Name and Category parameters, until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46595

Affected Products

Fireflow

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-46595 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46595 · Vendor Advisory
• https://t.me/cvenotify/60353 · Telegram Post
• https://t.me/cvenotify/61320 · Telegram Post
• https://cwe.mitre.org/data/definitions/79.html · Note
• https://t.me/cveNotify/142497 · Telegram Post
• https://t.me/cibsecurity/73417 · Telegram Post