Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

What to know

What it is

Zoho Flow versions up to 2.14.5 have an unauthenticated PHP Object Injection vulnerability. An attacker could exploit this to gain high privileges, read, modify or delete data, and perform other malicious actions.

Affected

{'products': ['Zoho Flow'], 'packages': [], 'versions': ['<= 2.14.5']}

Fix

Upgrade to a version greater than 2.14.5

Exploitation

No known exploitation