TIM Solution TIM BPM Suite and TIM FLOW Privilege Escalation Vulnerability

A vulnerability allowing remote privilege escalation has been identified in TIM Solution GmbH's TIM BPM Suite and TIM FLOW, prior to version 9.1.2. This issue arises because the application stores password hashes using the MD5 hashing algorithm, which is considered weak. An attacker can exploit this vulnerability to access and manipulate user data and workflows.

Impact

Exploitation of this vulnerability allows remote attackers to escalate privileges and access password hashes stored in MD5 format, enabling further exploitation of the application.

Remediation

The vendor has released a patch for this vulnerability in version 9.1.2. However, this fix has not yet been independently verified.