Digiwin EasyFlow GP Insufficiently Protected Credentials Vulnerability

A vulnerability allowing privileged remote attackers to access plaintext Active Directory and system email credentials from the EasyFlow GP frontend has been identified. This issue arises from insufficient protection of credentials, enabling exploitation by attackers with elevated privileges.

Impact

Exploitation of this vulnerability allows for unauthorized access to Active Directory and system email credentials, which could be misused for further attacks or unauthorized actions within the system.

Remediation

Users are advised to update EasyFlow GP version 5.8.x to 5.8.11.1.081013 or later, and version 8.1.x to 8.1.1.3 or later. For version 5.7.x, upgrade to an unaffected version or install the available patch.