CVE-2024-6633

CRITICAL

9.8

Description

The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/27/2024

Last Modified8/29/2025

Sourcenvd

Honeypot Sightings0

Affected Products

fortra:filecatalyst_workflow

Weaknesses (CWE)

CWE-200CWE-798CWE-798

References

https://www.fortra.com/security/advisories/product-security/fi-2024-011(df4dee71-de3a-4139-9588-11b62fe6c0ff)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.