Vulnerability · Published Aug 27, 2024 · Assigned by Fortra
CVE-2024-6633Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)
Critical 9.8
In plain English
A critical-severity information exposure in FileCatalyst Workflow from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).
Official description
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | FileCatalyst Workflow | 5.0.4 – through 5.1.6 Build 139 |
Weakness: CWE-200, CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H