CVE-2004-1631: Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by speci...

Security readout for executives and security teams

OpenWFE 1.4.x could be abused as a relay for network reconnaissance. An attacker may make the vulnerable web client contact other hosts through an RMI Worklist URL and infer whether ports are open from response timing. The sources do not show data theft, code execution, a patch version, or active exploitation. Exposure is likely limited to organizations still running OpenWFE/Open WorkFlow Engine 1.4.x with the affected web client reachable by untrusted users. Because this is a 2004-era product issue and sources lack current asset data, modern exposure is uncertain. Prioritize as an exposure-confirmation task, especially in legacy environments. It is not supported by active exploitation evidence, but it can help attackers map internal networks if an affected instance remains reachable. Mitigation focus: Inventory systems for OpenWFE or Open WorkFlow Engine 1.4.x.; Check vendor or archived project guidance for supported fixes or upgrades.; Restrict access to any OpenWFE web client from untrusted networks..

Prepared

Jun 30, 2026, 00:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.