PT-2019-14514 · Humanica · Humanica Humatrix

Publicado 2019-09-10 · Atualizado 2019-09-11 · CVE-2019-16106

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Humanica Humatrix versions 1.0.0.203 through 1.0.0.681

Description The issue affects the Recruitment module, allowing an unauthenticated attacker to change the password of any user. This is achieved through the recruitment online/personalData/act acounttab.cfm endpoint, utilizing the txtNewUserName and hdNP fields.

Recommendations For Humanica Humatrix versions 1.0.0.203 through 1.0.0.681, consider restricting access to the recruitment online/personalData/act acounttab.cfm endpoint until a fix is available. As a temporary workaround, avoid using the txtNewUserName and hdNP fields in this endpoint to minimize the risk of exploitation.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-16106

Produtos afetados

Humanica Humatrix

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-16106 · Aviso do Fabricante
• https://gist.github.com/suphapholt/5bac4f5cabadfc44746e2bc93c1be91d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16106 · Nota de Segurança
• https://humatrix7.com/sunfish5/ehrm/humanica/recruitment_online/personalData/qry_account.cfm · Nota