CVE-2024-9970
Reliance on Cookies without Validation and Integrity Checking (CWE-565)
Published: Oct 15, 2024 / Updated: 36d ago
010
CVSS 8.8EPSS 0.05%High
CVE info copied to clipboard
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
CVE Assignment
NVD published the first details for CVE-2024-9970
Oct 15, 2024 at 4:15 AM
First Article
Feedly found the first article mentioning CVE-2024-9970. See article
Oct 15, 2024 at 4:24 AM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Oct 15, 2024 at 4:24 AM
EPSS
EPSS Score was set to: 0.05% (Percentile: 20.1%)
Oct 15, 2024 at 10:16 AM
Affected Systems
Newtype/flowmaster_bpm_plus
+null more
Attack Patterns
CAPEC-226: Session Credential Falsification through Manipulation
+null more
News
【Vulnerability Alert】 Critical Security Vulnerabilities Found in NewType Infortech FlowMaster ...
Source: Ministry of education information & communication security contingency platform 【Vulnerability Alert】 Critical Security Vulnerabilities Found in NewType Infortech FlowMaster BPM Plus [Content]
Security Bulletin 16 Oct 2024 - Cyber Security Agency of Singapore
https:// nvd . nist .gov/vuln/detail/ CVE -2024-9985. CVE -2024-47875, DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML ...
High - CVE-2024-9970 - The FlowMaster BPM Plus system from NewType has...
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a...
CVE-2024-9970 | NewType FlowMaster BPM Plus up to 5.3.0 cookie validation
A vulnerability was found in NewType FlowMaster BPM Plus up to 5.3.0 and classified as very critical . Affected by this issue is some unknown functionality. The manipulation leads to cookies without validation. This vulnerability is handled as CVE-2024-9970 . The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
CVE-2024-9970 - NewType FlowMaster BPM Plus Cookie Tampering Privilege Escalation
CVE ID : CVE-2024-9970 Published : Oct. 15, 2024, 4:15 a.m. 53 minutes ago Description : The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie. Severity: 8.8
See 5 more articles and social media posts