CVE-2021-35964
Learningdigital.com, Inc. Orca HCM - Broken Authentication
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.3EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
19 Jul 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Learningdigital.com, Inc. · Orca HCMWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →