Umbraco Workflow's Backoffice users can execute arbitrary SQL
Date: 2024-04
Affected: nuget/Plumber.Workflow, nuget/Umbraco.Workflow, nuget/Umbraco.Workflow
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-32872
CWE: CWE-89
CVSS: 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N)

### Impact Backoffice users can execute arbitrary SQL. ### Explanation of the vulnerability A Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server. ### Affected versions All versions ### Patches Workflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2 ### References [Upgrading Umbraco Workflow](https://docs.umbraco.com/umbraco-workflow/upgrading/upgrading)


Mitigations:

Architectural layers (MAESTRO):