PT-2020-20175 · Kronos · Kronos Web Time/Attendance

Published 2020-01-30 · Updated 2021-07-21 · CVE-2020-8495

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance (webTA) versions 3.8.x through 3.x before 4.0

Description The issue allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application. This is achieved via the delegate, delegateRole, and delegatorUserId parameters in the com.threeis.webta.H491delegate servlet.

Recommendations For versions 3.8.x through 3.x before 4.0, consider restricting access to the com.threeis.webta.H491delegate servlet until a patch is available. As a temporary workaround, limit the use of the delegate, delegateRole, and delegatorUserId parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-8495

Affected Products

Kronos Web Time/Attendance

References · 7

• 🔥 http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html · Exploit
• 🔥 http://nolanbkennedy.com/post/privilege-escalation-in-kronos-web-time-and-attendance-webta · Exploit
• 🔥 https://exploit-db.com/exploits/48001 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8495 · Security Note
• https://kronos.com/products/kronos-webta · Vendor Advisory
• https://t.me/cvenotify/689 · Telegram Post