In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
Weakness
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement’s meaning or to execute arbitrary SQL commands.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tim_flow | Tim-solutions | * | 9.1.2 (excluding) |