Known Issue: FME Flow LDAP Credential Encryption Weakness

*FME Cloud was renamed to FME Flow Hosted for FME 2023.0. 
 

We have not identified active exploitation of this vulnerability in any of our products.

Symptom

Weaknesses in the encryption scheme used for encrypting LDAP account credentials in FME Server could be exploited to allow an attacker to gain unauthorized access to the server or environment. 
 

Cause

An adversary with read access to a configuration or backup file may be able to reverse engineer and decrypt sensitive data, such as passwords. 
 

Severity

Safe Software assesses the severity of this vulnerability as Medium, according to our calculated CVSS score of 6.4. This is our assessment, and you should evaluate its applicability to your own IT environment.
 

Resolution 

Upgrade to FME Flow 2023.0 or newer, where this issue has been resolved. See the Downloads page for the latest version and our documentation for upgrading instructions. If you need assistance upgrading, please contact one of our Partners. 
 

Workarounds

If you are unable to upgrade to FME Flow 2023.0+, we recommend the following workaround:

• Use alternative authentication services (Azure AD, Generic Directory, SAML) or System Authentication.

Recognition 

We would like to thank Malware Security for making this responsible disclosure and recognize their contribution to increasing the security standard of the FME Platform.
 

Reporting Security Issues

If you believe you have discovered a vulnerability in the FME Platform, our website, or our other products, please email us as quickly as possible at security at safe dot com.

We greatly appreciate the efforts of security researchers and discoverers who share information on security issues with us, giving us a chance to improve our products and better protect our users.

Please note that we do not compensate individuals or organizations for identifying potential or confirmed security vulnerabilities.
 

Support

If you have questions or concerns regarding this advisory, please raise a support request.