Fortra has released patches for two vulnerabilities in FileCatalyst Workflow impacts version 5.1.6 Build 139 and earlier.
The first vulnerability tracked as CVE-2024-6633 with a CVSS score of 9.8 is described as insecure default in the FileCatalyst Workflow Setup that reuires specific conditions: the software must be configured with the bundled HSQL database, be accessible to the attacker and potentially manipulating or exfiltrating data and creating admin users, though their access remains sandboxed.
The root cause of the problem is the default credentials for the setup HSQL database (HSQLDB) that were disclosed by the vendor in a knowledgebase article.
The second flaw addressed is a SQL injection issue tracked as CVE-2024-6632. The attack on FileCatalyst Workflow requires super admin credentials to access the UI screen with the vulnerable field (phone number). However, since there is only one super admin, if an attacker compromises these credentials, they would have no need for the SQL injection as they would already possess far more dangerous privileges.
Fortra recommends that customers update FileCatalyst Workflow version 5.1.7 build 156 or later and says it’s not having evidence of exploitation
