Manual patch for security vulnerability - how to replace files ensuring permissions

Hi ​@catherinep,

All files within the install directory <FMEFlowDir> should have the same permissions. Since it sounds like you’re on Windows, this is located at C:\Program Files\FMEFlow\ by default. 

From our Permissions docs page, Read/Write permissions on <FMEFlowDir> are required for the account which runs the Core, Engines and Web App Server. You can check which account is running these in Services:

To ensure permissions are correct, you have two options:

1. Paste in the patch files, and check each file’s permissions individually.
2. Paste in all of the patch files, and set permissions (with inheritance) at the directory level.

We generally recommend restarting Flow after making permission changes. 

Please let me know if you have any more questions about this! I’m happy to go into more detail if anything’s unclear. 

Thanks for the reply.  

To update this request: we successfully applied the manual patch to our instance of FME Server v2022.2.  We simply used copy and paste to update the individual files with the Program Files directory in the relevant directories - C:\Program Files\FMEServer\Utilities\tomcat\webapps\fmeapiv4\WEB-INF

The destination directory permissions remained unchanged, and the newer versions of the files maintained the same file permission.  

FME Server restarted and working as normal post the manual patching.  

Glad to hear everything’s working @catherinep! Just realised I forgot to mention in my last message that 2022 is outside of our three-year support scope so we highly recommend upgrading. There’s a great deal of new features, bug fixes, and important security updates in newer versions.

You’re more than welcome to continue asking questions here on the Community regardless of version, but we’ll be very limited in the help we can provide over Customer Support.