Description (CNA)
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
- https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/
ADP enrichment
No English description supplied.
No references supplied.