NewType FlowMaster BPM Plus - Privilege Escalation

Vulnerability

A privilege escalation vulnerability exists in the FlowMaster BPM Plus system from NewType. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie. The affected versions are those before Service Pack v5.3.1 [1][2].

Exploitation

Exploitation requires an attacker to have regular user privileges on the system and network access. By tampering with a specific cookie value, the attacker can escalate their privileges to administrator [1][2].

Impact

Successful exploitation allows the attacker to gain full administrative control over the FlowMaster BPM Plus system, leading to high confidentiality, integrity, and availability impact [2].

Mitigation

The issue is fixed in Service Pack v5.3.1 or later. Users should update to this version [2]. No workarounds are mentioned in the references.