Progress Flowmon vulnerabilities

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, an authenticated low-privileged user can craft a request during PDF generation, leading to operations performed with another user's privileges. This may result in unauthorized access to sensitive data and unintended system configuration changes.

In Progress Flowmon versions prior to 12.5.8, an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.

A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.

In Progress Flowmon versions prior to 12.5.6, certain system configuration files have incorrect file permissions. A user with access to the default flowmon system account (SSH) may potentially escalate privileges to root during service initialization.