CVE-2024-8584

Published Sep 9, 2024

Last updated a month ago

CVSS critical 9.8

Overview

Description: Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.
Source: twcert@cert.org.tw
NVD status: Modified

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

twcert@cert.org.tw: CWE-306
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7C124B76-9742-4EC2-93D5-B34039A6159E",
            "versionEndExcluding": "11.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References