CVE-2021-35964
7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Learningdigital.com, Inc. | Orca HCM | unspecified <= 10.0 | affected |
Weaknesses
- CWE-285: CWE-285 Improper Authorization
ADP Enrichment
CVE Program Container
Additional References
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
- https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html
References
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
- https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.