Vulnerability Description
The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Newtype | Flowmaster Bpm Plus | < 5.3.1 |
Related Weaknesses (CWE)
References
- https://www.twcert.org.tw/en/cp-139-8139-4daab-2.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-8138-d2bb7-1.htmlThird Party Advisory
FAQ
What is CVE-2024-9971?
CVE-2024-9971 is a vulnerability with a CVSS score of 8.8 (HIGH). The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify...
How severe is CVE-2024-9971?
CVE-2024-9971 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-9971?
Check the references section above for vendor advisories and patch information. Affected products include: Newtype Flowmaster Bpm Plus.