Unrestricted Access to Administrator Accounts in Orca HCM
CVE-2024-8584

9.8CRITICAL

Key Information:

Vendor
Learning Digital
Status
Orca Hcm
Vendor
CVE Published:
9 September 2024

Summary

Orca HCM, developed by LEARNING DIGITAL, has a significant access control vulnerability that allows unauthenticated remote attackers to exploit a specific functionality. This flaw enables attackers to create an account with administrator privileges without proper authorization, leading to potential unauthorized access and control over the system. The vendor is actively addressing the issue to provide a patch and secure the affected product.

Affected Version(s)

Orca HCM 0

References

https://www.twcert.org.tw/tw/cp-132-8039-24e48-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8040-948ef-2.html
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.