VulnerabilityModified
CVE-2021-35967
Remote attackers can access the system directory thru Path Traversal without logging in.
MEDIUM 5.3EPSS 1.32%
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- learningdigital/orca hcm
- Source
- twcert@cert.org.tw
References
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Not Applicable
- https://www.twcert.org.tw/tw/cp-132-4927-bbf01-1.htmlThird Party Advisory
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Not Applicable
- https://www.twcert.org.tw/tw/cp-132-4927-bbf01-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.