Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Fortra Releases Security Advisories for FileCatalyst Workflow

Advisories address two vulnerabilities, one rated as critical and the other as high severity

Threat ID:
CC-4540
Threat Severity:
Medium
Published:
28 August 2024 4:34 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Advisories address two vulnerabilities, one rated as critical and the other as high severity

Affected platforms

The following platforms are known to be affected:

Versions: 5.1.6 Build 139 and earlier

Fortra FileCatalyst

Threat details

Introduction

Fortra has released security advisories addressing a critical vulnerability and a high severity vulnerability found in FileCatalyst Workflow. FileCatalyst is an accelerated file transfer software solution that allows the transfer of large files over remote networks.

  • CVE-2024-6632 is an SQL injection vulnerability with a CVSSv3 score of 7.2 (high), which if exploited could allow an unauthenticated attacker to modify or delete data in the application database, and create administrative users.

  • CVE-2024-6633 is a insecure default vulnerability with a CVSSv3 score of 9.8 (critical) that could allow an unauthenticated attacker remote access to the database, permitting data manipulation or exfiltration from the database, and admin user creation with access levels contained to the sandbox.

Remediation advice

Affected organisations are encouraged to review Forta Security Advisories FI-2024-010 and FI-2024-011, the additional information in FileCatalyst Workflow Database Vulnerabilities, and update to version 5.1.7 or later.

Last edited: 28 August 2024 4:36 pm