CVE-2024-5683 - Remote Code Execution in Next4Biz's BPM

Back Back to CVE browser

CRITICAL

Remote Code Execution in Next4Biz's BPM

Published Jun 24, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.51%

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion.

This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5.

Affected products

Vendor Next4Biz CRM & BPM Software Product Business Process Manangement (BPM) Default
unaffected
- Version
  6.6.4.4
  Status
  affected
  Constraints
  <6.6.4.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Next4Biz CRM & BPM Software

Business Process Manangement (BPM)

unaffected

Version	Status	Constraints
6.6.4.4	affected	<6.6.4.5

Vendor Next4biz Crm and Bpm Software Product Business Process Manangement Default
n/a
- Version
  6.6.4.4
  Status
  affected
  Constraints
  <6.6.4.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Next4biz Crm and Bpm Software

Business Process Manangement

n/a

Version	Status	Constraints
6.6.4.4	affected	<6.6.4.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46856
Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0739
government-resource
https://www.usom.gov.tr/bildirim/tr-24-0739
government-resourcebroken-link

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46856		Advisory
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0739		government-resource
https://www.usom.gov.tr/bildirim/tr-24-0739		government-resourcebroken-link