PT-2020-14106 · Kronos · Kronos Webta

Published 2020-07-15 · Updated 2020-07-22 · CVE-2020-14982

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kronos WebTA versions 3.8.x through 3.9.x

Description A Blind SQL Injection issue affects the com.threeis.webta.H352premPayRequest servlet's SortBy parameter, allowing an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database.

Recommendations For Kronos WebTA versions 3.8.x through 3.9.x, consider disabling the com.threeis.webta.H352premPayRequest servlet or restricting access to the SortBy parameter until a patch is available. Update to version 4.0 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-14982

Affected Products

Kronos Webta

References · 5

• 🔥 https://mindpointgroup.com/blog/webta-sqli-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2020-14982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14982 · Security Note
• https://mindpointgroup.com/articles · Note
• https://t.me/cvenotify/5082 · Telegram Post