CVE-2024-12235 – Shenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access control

https://notcve.org/view.php?id=CVE-2024-12235

05 Dec 2024 — A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file \agile-bpm-basic-master\ab-auth\ab-auth-spring-security-oauth2\src\main\java\com\dstz\auth\filter\AuthorizationTokenCheckFilter.java. The manipulation leads to improper access controls. The attack can be launched remotely. • https://github.com/sweatxi/rce/blob/main/AgileBPM_vertical_overreach.md • CWE-266: Incorrect Privilege Assignment CWE-284: Improper Access Control •