Hard-coded Password Vulnerability in FileCatalyst TransferAgent Could Lead to MiTM Attacks

CVE-2024-5275

Summary

The vulnerability arises from a hard-coded password embedded in the FileCatalyst TransferAgent, which provides a potential pathway for unauthorized users to access sensitive keystore contents, such as private keys for certificates. This flaw permits attackers to exploit the agent, enabling man-in-the-middle (MiTM) attack scenarios that could compromise the confidentiality and integrity of data being transferred. All versions of FileCatalyst Direct prior to 3.8.10 Build 138 and FileCatalyst Workflow prior to 5.1.6 Build 130 are affected, necessitating immediate mitigation actions by users to secure their environments.

References