CVE-2022-39038 HIGH

CVE-2022-39038: FLOWRING Agentflow BPM - Broken Access Control

Vendor Flowring
Product Agentflow BPM
Weakness CWE-287 · Improper authentication
Published November 10, 2022
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.

Key dates

02Disclosure timeline

November 10, 2022 CVE published
May 1, 2025 Record updated