PT-2021-21084 · Orca Hcm · Orca Hcm

Jia-Rong Chen · Published 2021-07-19 · Updated 2022-10-27 · CVE-2021-35964

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform (affected versions not specified)

Description: The management page of the Orca HCM digital learning platform does not perform identity verification, allowing remote attackers to execute management functions without logging in. This enables attackers to access members' information, modify and delete courses in the system, causing users to fail to access the learning content.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Improper Authorization

Weakness Enumeration

CWE-287

CWE-285

Related Identifiers

CVE-2021-35964

Affected Products

Orca Hcm

References · 6

• https://osv.dev/vulnerability/CVE-2021-35964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35964 · Security Note
• https://t.me/cvenotify/18236 · Telegram Post
• https://chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25 · Note
• https://t.me/cvenotify/17830 · Telegram Post
• https://twcert.org.tw/tw/cp-132-4924-f74d5-1.html · Note