by Kastro
Paper/Archive/CVE-2021-35964

CVE-2021-35964

Learningdigital.com, Inc. Orca HCM — Learningdigital.com, Inc. Orca HCM - Broken Authentication

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.2.652 × 2013.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.

Affected

ProductAffectedFixed inSource
Orca HCMunspecified – 10.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

refchtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25reftwcert.org.tw/tw/cp-132-4924-f74d5-1.html