Vulnerability · Published Oct 15, 2024 · Assigned by twcert
CVE-2024-9970NewType FlowMaster BPM Plus - Privilege Escalation
High 8.8
In plain English
A high-severity security flaw in FlowMaster BPM Plus from NewType. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 50.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NewType | FlowMaster BPM Plus | 0 – before 5.3.1 |
Weakness: CWE-565 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8136-4d5b4-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8137-ea537-2.html third-party-advisory