medium5.5
CVE-2024-32872
Umbraco Workflow's Backoffice users can execute arbitrary SQL
Impact
### Impact Backoffice users can execute arbitrary SQL. ### Explanation of the vulnerability A Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server. ### Affected versions All versions ### Patches Workflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2 ### References [Upgrading Umbraco Workflow](https://docs.umbraco.com/umbraco-workflow/upgrading/upgrading)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Workflow | < 10.3.9 | 10.3.9 |
| nuget | Plumber.Workflow | < 10.1.2 | 10.1.2 |