TIM BPM Suite and TIM FLOW Hibernate Query Language Injection Vulnerability

A Hibernate Query Language (HQL) injection vulnerability has been identified in TIM BPM Suite/TIM FLOW versions prior to 9.1.2. This vulnerability allows a low-privileged user to inject HQL queries, potentially leading to the extraction of passwords and sensitive data from other users.

Impact

Exploitation of this vulnerability could result in unauthorized access to other users' passwords and sensitive data.

Remediation

The vendor has released a silent fix for this vulnerability. However, as of now, the implemented security measures have not been verified.