CVE-2024-5275 json
Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)
published 2024-06-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-46511
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middle (MiTM) attack against users of the agent. This issue affects all versions of FileCatalyst Direct from 3.8.10 Build 138 and earlier and all versions of FileCatalyst Workflow from 5.1.6 Build 130 and earlier.
Patch / fix
- fortra filecatalyst_direct 3.8.10
- fortra filecatalyst_workflow 5.1.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Fortra FileCatalyst Direct
- Fortra FileCatalyst Workflow
- fortra filecatalyst_direct
- fortra filecatalyst_workflow
Classification
- Weakness
-
- CWE-259 Use of Hard-coded Password
References
Sources
- CVE List CVE-2024-5275
- NVD CVE-2024-5275
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.