{"id":"GHSA-287f-46j7-j4wh","summary":"Umbraco Workflow's Backoffice users can execute arbitrary SQL","details":"### Impact\n\nBackoffice users can execute arbitrary SQL.\n\n### Explanation of the vulnerability\nA Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server.\n\n### Affected versions \nAll versions\n\n### Patches\n\nWorkflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2\n\n### References\n[Upgrading Umbraco Workflow](https://docs.umbraco.com/umbraco-workflow/upgrading/upgrading)\n","aliases":["CVE-2024-32872"],"modified":"2024-04-24T17:28:26.073021Z","published":"2024-04-24T17:04:34Z","database_specific":{"github_reviewed_at":"2024-04-24T17:04:34Z","nvd_published_at":"2024-04-24T15:15:48Z","cwe_ids":["CWE-89"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32872"}],"affected":[{"package":{"name":"Umbraco.Workflow","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Workflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.9"}]}],"versions":["10.0.0","10.1.0","10.1.0-rc1","10.1.1","10.1.2","10.2.0","10.2.0-rc1","10.2.1","10.2.2","10.2.3","10.3.0","10.3.0-rc1","10.3.1","10.3.2","10.3.3","10.3.4","10.3.5","10.3.6","10.3.7","10.3.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-287f-46j7-j4wh/GHSA-287f-46j7-j4wh.json"}},{"package":{"name":"Umbraco.Workflow","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Workflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc1"},{"fixed":"12.2.6"}]}],"versions":["11.0.0","11.0.0-rc1","11.0.0-rc2","11.0.0-rc3","11.0.1","11.1.0","11.1.0-rc1","11.1.1","11.1.2","11.2.0","11.2.0-rc1","11.2.1","11.2.2","11.2.3","11.3.0","11.3.0-rc1","11.3.1","11.3.2","12.0.0","12.0.0-rc1","12.0.0-rc2","12.0.0-rc4","12.0.1","12.1.0","12.1.0-rc1","12.1.1","12.1.2","12.2.0","12.2.0-rc1","12.2.1","12.2.2","12.2.3","12.2.4","12.2.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-287f-46j7-j4wh/GHSA-287f-46j7-j4wh.json"}},{"package":{"name":"Umbraco.Workflow","ecosystem":"NuGet","purl":"pkg:nuget/Umbraco.Workflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0-rc1"},{"fixed":"13.0.6"}]}],"versions":["13.0.0","13.0.0-rc1","13.0.0-rc2","13.0.1","13.0.2","13.0.3","13.0.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-287f-46j7-j4wh/GHSA-287f-46j7-j4wh.json"}},{"package":{"name":"Plumber.Workflow","ecosystem":"NuGet","purl":"pkg:nuget/Plumber.Workflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.2"}]}],"versions":["1.0.0","1.0.0-alpha-000230","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.2-beta-000314","1.1.3","1.1.3-beta-000315","1.1.3-beta-000318","1.1.3-beta-000319","1.1.3-beta-000329","1.1.4-beta-000333","1.2.0","1.2.0-beta-000339","1.2.0-beta-000340","1.2.0-beta-000341","1.2.0-beta-000342","1.2.0-beta-000343","1.2.0-beta-000344","1.2.0-beta-000345","1.2.0-beta-000346","1.2.0-beta-000349","1.2.0-beta-000350","1.2.0-beta-000351","1.2.0-beta-000355","1.2.0-beta-000356","1.2.0-beta-000357","1.2.0-beta-000359","1.2.0-beta-000360","1.2.0-beta-000363","1.2.1","1.2.1-beta-000365","1.2.1-beta-000366","1.2.1-beta-000367","1.2.1-beta-000368","1.2.1-beta-000371","1.2.2-beta-000372","1.3.0","1.3.0-beta-000375","1.3.1","1.3.1-beta-000377","1.3.2","1.3.3","1.3.3-beta-000382","1.3.4","1.3.5","1.3.5-beta-000389","1.3.5-beta-000390","1.3.5-beta-000391","1.3.5-beta-000393","1.3.6","1.3.6-beta-000395","1.3.7","1.3.7-beta-000398","1.3.7-beta-000403","1.3.8","1.3.8-beta-000406","1.3.8-beta-000407","1.3.8-beta-000408","1.3.8-beta-000409","1.3.8-beta-000410","1.3.8-beta-000412","1.3.9","1.3.9-beta-000414","1.3.9-beta-000415","1.3.9-beta-000416","1.3.9-beta-000417","1.3.9-beta-000418","1.3.9-beta-000419","1.3.9-beta-000420","1.3.9-beta-000423","1.4.0","1.4.0-beta-000424","1.4.0-beta-000426","1.4.0-beta-000428","1.4.0-beta-000430","1.4.0-beta-000431","1.4.0-beta-000432","1.4.0-beta-000433","1.4.0-beta-000437","1.4.0-beta-000438","1.4.1","1.4.1-beta-000454","1.4.1-beta-000455","1.4.1-beta-000458","1.4.1-beta-000460","1.4.1-beta-000463","1.4.2","1.4.2-beta-000466","1.4.3","1.4.3-beta-000468","1.4.3-beta-000469","1.4.3-beta-000470","1.4.3-beta-000471","1.4.3-beta-000472","1.4.3-beta-000473","1.4.3-beta-000476","1.4.3-beta-000477","1.4.3-beta-000478","1.4.3-beta-000479","1.4.4-beta-000482","1.4.4-beta-000484","1.4.4-beta-000485","1.4.4-beta-000486","1.4.4-beta-000487","1.4.4-beta-000488","1.4.4-beta-000489","1.4.4-beta-000490","1.4.4-beta-000491","1.4.4-beta-000492","1.4.4-beta-000493","1.4.4-beta-000494","1.4.4-beta-000495","1.4.4-beta-000496","1.4.4-beta-000497","1.4.4-beta-000498","1.4.4-beta-000499","1.5.0","1.5.0-beta-000505","1.5.1","1.5.1-beta-000508","1.5.1-beta-000509","1.5.1-beta-000510","1.5.1-beta-000512","1.5.1-beta-000513","1.5.1-beta-000520","1.5.2","1.5.2-beta-000521","1.5.2-beta-000522","1.5.2-beta-000534","1.5.2-beta-000536","1.5.2-beta-000539","1.5.3","1.5.3-beta-000540","1.5.3-beta-000542","1.5.3-beta-000546","1.6.0","1.6.0-beta-000553","1.6.0-beta-000554","1.6.0-beta-000557","1.6.0-beta-000559","1.6.0-beta-000560","1.6.0-beta-000562","1.6.0-beta-000565","1.6.1","1.6.1-beta-000566","1.6.1-beta-000567","1.6.1-beta-000572","1.6.2","1.6.2-beta-000573","1.6.3","1.6.3-beta-000576","1.6.3-beta-000616","1.6.3-beta-000627","1.6.3-beta-000629","1.6.3-beta-000630","1.6.3-beta-000631","1.6.3-beta-000633","1.6.3-beta-000634","1.6.3-beta-000638","1.6.3-beta-000643","1.6.3-beta-000648","1.6.3-beta-000651","1.6.4","1.6.4-beta-000654","1.6.4-beta-000656","1.6.5","1.6.5-beta-000773","1.6.6","1.6.6-beta-000775","1.6.6-beta-000776","1.6.6-beta-000778","1.6.6-beta-000781","1.6.6-beta-000782","1.6.6-beta-000784","1.6.6-beta-000786","1.6.7","1.6.7-beta-000823","1.6.8","1.6.8-beta-000841","1.6.8-beta-000843","1.6.8-beta-000846","1.6.9-beta-000874","10.0.0","10.0.1","10.0.2-rc","10.1.0","10.1.0-rc","10.1.1","2.0.0","2.0.0-rc001","2.0.1","2.0.2","2.1.0","2.1.0-rc","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","8.0.0-beta-000646","9.0.0-beta-000584","9.0.0-beta-000611","9.0.0-beta-000617"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-287f-46j7-j4wh/GHSA-287f-46j7-j4wh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N"}]}