by Kastro
Paper/Archive/CVE-2024-8584

CVE-2024-8584

LEARNING DIGITAL Orca HCM — LEARNING DIGITAL Orca HCM - Missing Authentication

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.

Affected

ProductAffectedFixed inSource
Orca HCM< 11.011.0CNA
orca_hcm< 11.011.0CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8039-24e48-1.htmlwriteuptwcert.org.tw/en/cp-139-8040-948ef-2.html