Critical · published August 28, 2025
🚨 An admin with the right scripts could run wild! In Valtimo versions before 12.16.0.RELEASE and 13.0.0.RELEASE to 13.1.2.RELEASE, unauthorized access to sensitive data is just a few clicks away! 🔥 Think of it like a chef in a restaurant who can modify the menu at will. If that chef also has the keys to the safe, they could cook up more than just dinner—like pilfering cash or secret recipes! 🍽️ This vulnerability could allow an attacker to execute arbitrary code on the application host, exposing sensitive data or resources like a master key unlocks every door in a secure building. With this access, they could manipulate application settings, read confidential data, or even wreak havoc on your database! That's an absolutely devastating scenario for any business.
Think of it like a chef in a restaurant who can modify the menu at will. If that chef also has the keys to the safe, they could cook up more than just dinner—like pilfering cash or secret recipes! 🍽️ This vulnerability arises when an administrator, logged into Valtimo, can create, modify, and execute process definitions without sufficient checks, leveraging the Camunda/Operator engine to gain unauthorized access to sensitive system resources.
This vulnerability could allow an attacker to execute arbitrary code on the application host, exposing sensitive data or resources like a master key unlocks every door in a secure building. With this access, they could manipulate application settings, read confidential data, or even wreak havoc on your database! That's an absolutely devastating scenario for any business. To safeguard your environment, urgently upgrade to Valtimo version 12.16.0 or 13.1.2 and beyond. If scripting is unnecessary, consider disabling it in your ProcessEngineConfiguration, but be aware of potential side effects. Don't delay—protect your data! 🛡️ You've got this! Follow these steps and secure your Valtimo platform for good! 💪✨