PT-2024-39120 · Learning Digital · Orca Hcm

Chunhao Yang + 1 · Published 2024-09-08 · Updated 2025-02-17 · CVE-2024-8584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITAL (affected versions not specified)

Description: The issue is related to a missing authentication vulnerability, allowing an unauthenticated remote attacker to exploit the functionality and create an account with administrator privileges, subsequently using it to log in. This vulnerability enables unauthorized access, risking administrator account creation and access by remote attackers.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2024-8584

Affected Products

Orca Hcm

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2024-8584 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8584 · Vendor Advisory
• https://twitter.com/vuldb/status/1833013476371108318 · Twitter Post
• https://t.me/cvenotify/111543 · Telegram Post
• https://twitter.com/CVEnew/status/1832983863980671090 · Twitter Post
• https://t.me/cvenotify/93745 · Telegram Post
• https://t.me/cvenotify/94216 · Telegram Post
• https://twcert.org.tw/en/cp-139-8040-948ef-2.html · Note
• https://twitter.com/AegisLens/status/1833039019803840719 · Twitter Post
• https://t.me/cvenotify/94492 · Telegram Post
• https://twitter.com/CveFindCom/status/1832985919537746220 · Twitter Post
• https://t.me/cvedetector/5092 · Telegram Post
• https://twcert.org.tw/tw/cp-132-8039-24e48-1.html · Note
• https://twitter.com/cracbot/status/1834834510246297615 · Twitter Post
• https://t.me/latest_high_impact_cve/1117 · Telegram Post