CVE-2024-9970

Summary

CVE-2024-9970 identifies a privilege escalation vulnerability in the FlowMaster BPM Plus system developed by NewType, affecting multiple products including zgFyk7, zgFyk6, zeRkwJ, and zeRf5P. This vulnerability allows remote attackers with regular privileges to elevate their access to administrator status by manipulating a specific cookie. The risk associated with this vulnerability is considered high, with a base score of 8.8 on the CVSS scale, indicating significant potential impacts on confidentiality, integrity, and availability. To remediate this issue, organizations are advised to apply any available patches from NewType or implement security measures to monitor and restrict cookie tampering. Failure to address this vulnerability may result in unauthorized access to sensitive data and critical system functions within the organization.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.