Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

uniFLOW Online: Email Login Enables Malicious User Registration

CVE-2024-1621 · published 2 years ago
Summary

If email login is enabled in uniFLOW Online, attackers can register themselves as a legitimate user, giving them the same access and capabilities as the real user. This affects tenants using email login with Microsoft Safe Links or similar services. To protect your system, consider disabling email login until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
nt-ware uniflow_online <= 2024.1.0
cpe:2.3:a:nt-ware:uniflow_online:*:*:*:*:*:-:*:*
nt-ware uniflow_online_print_\&_scan All versions
cpe:2.3:a:nt-ware:uniflow_online_print_\&_scan:-:*:*:*:*:andriod:*:*
nt-ware uniflow_smartclient All versions
cpe:2.3:a:nt-ware:uniflow_smartclient:-:*:*:*:*:macos:*:*
Original advisory text
The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising ema...
The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-940Improper Verification of Source of a Communication Channel
Timeline
Published2 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-1621 · NVD
Track software like this
Free during beta