Description (CNA)
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TIM Solutions / TIM Flow | affected 0 before 26.0.6 |
CWE
CWE-862
References
- https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
- https://www.vulncheck.com/advisories/tim-flow-unauthorized-sql-query-execution-via-dashboard-export-endpoint
ADP enrichment
No English description supplied.
No references supplied.