Critical severity · published Nov 10, 2022
CVE-2022-39036
FLOWRING Agentflow BPM - Arbitrary File Upload
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Agentflow BPM · FLOWRING
4.0.0.1183.552 · source: vendor
AG
Agentflow · Flowring
4.0.0.1183.552 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39036
Vendor Advisory
https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-6682-21207-1.html
More from Agentflow BPM
8.8
CVE-2022-39038
FLOWRING Agentflow BPM - Broken Access Control
7.5
CVE-2022-39037
FLOWRING Agentflow BPM - Path Traversal