Lucene search

TwcertCVELIST:CVE-2021-35964

HistoryJul 19, 2021 - 12:00 a.m.

CVE-2021-35964 Learningdigital.com, Inc. Orca HCM - Broken Authentication

2021-07-1900:00:00

CWE-285

twcert

www.cve.org

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

9.8 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.6%

JSON

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.

CNA Affected

[
  {
    "product": "Orca HCM",
    "vendor": "Learningdigital.com, Inc.",
    "versions": [
      {
        "lessThanOrEqual": "10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25

www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

9.8 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.6%

JSON

Related for CVELIST:CVE-2021-35964