{"id":"CVE-2023-46595","aliases":["EUVD-2023-50798","GHSA-9jpv-w64v-mgr2"],"status":"published","title":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor","description":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above),  A32.50 (b390 or above)","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00348,"percentile":0.28687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-11-02T07:47:50Z","modified":"2026-06-17T06:31:10Z","products":[{"vendor":"algosec","product":"algosec fireflow"},{"vendor":"algosec","product":"fireflow"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/79.html","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46595"},{"url":"https://www.algosec.com/docs/en/cves/Content/tech-notes/cves/cve-2023-46595.htm"},{"url":"https://github.com/advisories/GHSA-9jpv-w64v-mgr2"}],"sources":{"cve":[{"id":"CVE-2023-46595","title":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor","description":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above),  A32.50 (b390 or above)","status":"published","published":"2023-11-02T07:47:50.794Z","modified":"2025-11-12T08:38:33.676Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50798","description":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above),  A32.50 (b390 or above)","status":"published","published":"2023-11-02T07:47:50Z","modified":"2025-11-12T08:38:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:18.896005Z"}],"ghsa":[{"id":"GHSA-9jpv-w64v-mgr2","title":"Net-NTLM leak in Fireflow A32.20 and A32.50 allows an attacker to obtain victim’s domain...","description":"Net-NTLM leak in Fireflow A32.20 and A32.50 allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks.","status":"published","published":"2023-11-02T09:30:18Z","modified":"2025-11-12T09:31:28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:45.782037Z"}],"nvd":[{"id":"CVE-2023-46595","description":"Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above),  A32.50 (b390 or above)","status":"published","published":"2023-11-02T08:15:08.04Z","modified":"2026-06-17T06:31:10.67Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:41.047232Z"}]}}