PT-2019-14514 · Humanica · Humanica Humatrix

Published 2019-09-10 · Updated 2019-09-11 · CVE-2019-16106

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Humanica Humatrix versions 1.0.0.203 through 1.0.0.681

Description The issue affects the Recruitment module, allowing an unauthenticated attacker to change the password of any user. This is achieved through the recruitment online/personalData/act acounttab.cfm endpoint, utilizing the txtNewUserName and hdNP fields.

Recommendations For Humanica Humatrix versions 1.0.0.203 through 1.0.0.681, consider restricting access to the recruitment online/personalData/act acounttab.cfm endpoint until a fix is available. As a temporary workaround, avoid using the txtNewUserName and hdNP fields in this endpoint to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-16106

Affected Products

Humanica Humatrix

References · 4

• https://osv.dev/vulnerability/CVE-2019-16106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16106 · Security Note
• https://gist.github.com/suphapholt/5bac4f5cabadfc44746e2bc93c1be91d · Note
• https://humatrix7.com/sunfish5/ehrm/humanica/recruitment_online/personalData/qry_account.cfm · Note