CVE-2025-8450 - Vulnerability Details - OpenCVE

Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Fortra	Filecatalyst Direct Filecatalyst Workflow

No data.

No data.

References

Link	Providers
https://www.fortra.com/security/advisories/product-security/fi-2025-010

History

Fri, 29 Aug 2025 20:30:00 +0000

Type	Values Removed	Values Added
References	https://www.cve.org/cverecord?id=CVE-2025-8450

Fri, 29 Aug 2025 20:15:00 +0000

Type	Values Removed	Values Added
References		https://www.fortra.com/security/advisories/product-security/fi-2025-010

Thu, 21 Aug 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortra Fortra filecatalyst Direct Fortra filecatalyst Workflow
Vendors & Products		Fortra Fortra filecatalyst Direct Fortra filecatalyst Workflow

Tue, 19 Aug 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 19 Aug 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
Title		Unrestricted File Upload in FileCatalyst
Weaknesses		CWE-306 CWE-434
References		https://www.cve.org/cverecord?id=CVE-2025-8450
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Fortra

Published: 2025-08-19T18:01:14.137Z

Updated: 2025-08-29T20:09:24.656Z

Reserved: 2025-07-31T21:30:46.989Z

Link: CVE-2025-8450

Vulnrichment

Updated: 2025-08-19T18:29:44.341Z

NVD

Status : Awaiting Analysis

Published: 2025-08-19T18:15:29.540

Modified: 2025-08-29T20:15:35.203

Link: CVE-2025-8450

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8450", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2025-07-31T21:30:46.989Z", "datePublished": "2025-08-19T18:01:14.137Z", "dateUpdated": "2025-08-29T20:09:24.656Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux"], "product": "FileCatalyst", "vendor": "Fortra", "versions": [{"lessThanOrEqual": "5.2.0 Build 80", "status": "affected", "version": "5.1.6", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page."}], "value": "Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page."}], "impacts": [{"capecId": "CAPEC-563", "descriptions": [{"lang": "en", "value": "CAPEC-563 Add Malicious File to Shared Webroot"}]}, {"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "CAPEC-650 Upload a Web Shell to a Web Server"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-08-29T20:09:24.656Z"}, "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-010"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the latest version of FileCatalyst, Version 5.2.0 - Build 130"}], "value": "Update to the latest version of FileCatalyst, Version 5.2.0 - Build 130"}], "source": {"discovery": "UNKNOWN"}, "title": "Unrestricted File Upload in FileCatalyst", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-19T18:29:37.440894Z", "id": "CVE-2025-8450", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T18:30:00.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-19T18:29:37.440894Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T18:29:44.341Z"}}], "cna": {"title": "Unrestricted File Upload in FileCatalyst", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-563", "descriptions": [{"lang": "en", "value": "CAPEC-563 Add Malicious File to Shared Webroot"}]}, {"capecId": "CAPEC-650", "descriptions": [{"lang": "en", "value": "CAPEC-650 Upload a Web Shell to a Web Server"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fortra", "product": "FileCatalyst", "versions": [{"status": "affected", "version": "5.1.6", "versionType": "semver", "lessThanOrEqual": "5.2.0 Build 80"}], "platforms": ["Windows", "MacOS", "Linux"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to the latest version of FileCatalyst, Version 5.2.0 - Build 130", "supportingMedia": [{"type": "text/html", "value": "Update to the latest version of FileCatalyst, Version 5.2.0 - Build 130", "base64": false}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-010"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.", "supportingMedia": [{"type": "text/html", "value": "Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-08-29T20:09:24.656Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8450", "state": "PUBLISHED", "dateUpdated": "2025-08-29T20:09:24.656Z", "dateReserved": "2025-07-31T21:30:46.989Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2025-08-19T18:01:14.137Z", "assignerShortName": "Fortra"}, "dataVersion": "5.1"}