{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-5275",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-5275",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-06-18T14:11:37.005Z",
    "updatedAt": "2024-08-01T21:11:12.408Z",
    "importedAt": "2026-10-24T01:57:20.494Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)",
      "summary": "A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middle (MiTM) attack against users of the agent. This issue affects all versions of FileCatalyst Direct from 3.8.10 Build 138 and earlier and all versions of FileCatalyst Workflow from 5.1.6 Build 130 and earlier.",
      "affected": [
        {
          "vendor": "Fortra",
          "product": "FileCatalyst Direct",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.7",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "3.8.10.138"
            }
          ]
        },
        {
          "vendor": "Fortra",
          "product": "FileCatalyst Workflow",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.9.8",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "5.1.6.130"
            }
          ]
        }
      ]
    }
  }
}