Agiloft Insecure Package Download Vulnerability

A vulnerability exists in Agiloft Release 28, where critical system packages are downloaded over an insecure HTTP connection. This flaw allows an attacker in a Man-In-the-Middle position to intercept and modify the contents of the download. The issue affects on-premise installations of Agiloft.

Impact

Exploitation could lead to unauthorized modification of downloaded packages, potentially allowing for malicious code execution or other harmful actions within the application.

Remediation

Users are advised to upgrade to Agiloft Release 30 or later, where this vulnerability has been addressed. Instructions for upgrading can be found in the Agiloft Release Notes.