PT-2019-13874 · Humanica · Humatrix

Nuttakorn Dhiraprayudti · Publicado 2019-08-12 · Atualizado 2021-07-21 · CVE-2019-14932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Humanica Humatrix versions 1.0.0.681 and 1.0.0.203

Description The issue allows remote attackers to access sensitive data, including personal information, by modifying the selApp variable to access the "personalData/resumeDetail.cfm" endpoint. This affects the Recruitment module, potentially exposing all candidates' information on the website.

Recommendations For version 1.0.0.681, restrict access to the "personalData/resumeDetail.cfm" endpoint to minimize the risk of exploitation. For version 1.0.0.203, avoid using the modified selApp variable in the Recruitment module until the issue is resolved. As a temporary workaround, consider disabling access to the Recruitment module until a fix is available.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-14932

Produtos afetados

Humatrix

Referências · 3

• 🔥 https://gist.github.com/donut117/1ddbb8290a1186502da81b46a5d53c63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14932 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14932 · Aviso do Fabricante