CVE-2022-39038 - CVE House
Back to Database
Status published High CVE-2022-39038

FLOWRING Agentflow BPM - Broken Access Control

Vulnerability Description

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39038

Credits & Attribution

No credits recorded in the NVD database.

References

More from FLOWRING

View All →
CVE-2022-39037
FLOWRING Agentflow BPM - Path Traversal
High 7.5
CVE-2022-39036
FLOWRING Agentflow BPM - Arbitrary File Upload
Critical 9.8

Affected Vendor

Affected Software

Agentflow BPM
Vulnerable Versions:
4.0.0.1183.552

Timeline

Official Publish: November 10th, 2022
Last Modified: May 1st, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access