CVE-2024-46480

High

Published: 13 January 2025

Published

13 January 2025

Modified

03 October 2025

KEV Added

—

Patch

—

CVSS Score 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0018 39.2th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-46480 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Venki Supravizio Bpm. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the specific NTLM hash leak flaw in Venki Supravizio BPM through timely identification, reporting, and correction of vulnerabilities.

IA-5 Authenticator Management good match

prevent

Protects NTLM hashes as authenticators from unauthorized disclosure and ensures sufficient strength to prevent their leak and subsequent privilege escalation.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to restrict Application Administrator access and limit escalation impact on the underlying host system even if an NTLM hash is obtained.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

T1550.002 Pass the Hash Lateral Movement

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

attack.mitre.org →

Why these techniques?

The vulnerability is an authenticated NTLM hash leak in Supravizio BPM exploited for credential access (T1212), enabling Pass the Hash (T1550.002) and overall privilege escalation to RCE on the host (T1068).

NVD Description

An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system.

Deeper analysisAI

CVE-2024-46480 is an NTLM hash leak vulnerability in Venki Supravizio BPM versions up to 18.0.1. Published on January 13, 2025, it carries a CVSS v3.1 base score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-522 (Insufficiently Protected Credentials). The flaw enables exposure of NTLM hashes within this business process management software.

An authenticated attacker with Application Administrator access can exploit the vulnerability over an adjacent network with low complexity. Successful exploitation allows privilege escalation on the underlying host system, providing high confidentiality, integrity, and availability impacts due to the changed scope.

Advisories and further details are available in the researcher's disclosure at https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46480.md and on the vendor's Supravizio page at https://www.venki.com.br/ferramenta-bpm/supravizio/.