CVE-2024-9970
NewType FlowMaster BPM Plus - Privilege Escalation
CVE-2024-9970 is a high vulnerability (CVSS 8.8) in New Type Flowmaster Bpm Plus, published October 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. No source names a fixed version.
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
NewType FlowMaster BPM Plus - Privilege Escalation
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- Record
CVE-2024-9970- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
EUVDEUVD-2024-50252
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- Record
EUVD-2024-50252- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g9c-pfqm-8rrr
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote...
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- Record
GHSA-7g9c-pfqm-8rrr- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
NVD
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- Record
CVE-2024-9970- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |