SQL Injection in Bizagi Business Process Management Suite

CVE-2014-2948

SQL injection vulnerability in workflowenginesoa.asmx in Bizagi BPM Suite through 10.4 allows remote authenticated users to execute arbitrary SQL commands via a crafted SOAP request.

Vulnerability class: SQL Injection

EPSS: 0.011 (62.0th percentile) — read the EPSS interpretation.

Affected products

Bizagi Business_process_management_suite — versions 10.0, 10.0.1, 10.1
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)