VulnerabilityModified
CVE-2021-35968
Remote attackers can access the system directory thru Path Traversal with users’ privileges.
MEDIUM 4.3EPSS 1.03%
Does this matter?
Lower severity and a low EPSS score (1.03%). Track it; it rarely justifies an emergency change on its own.
Description
The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.03% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- learningdigital/orca hcm
- Source
- twcert@cert.org.tw
References
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Not Applicable
- https://www.twcert.org.tw/tw/cp-132-4928-7e87b-1.htmlThird Party Advisory
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Not Applicable
- https://www.twcert.org.tw/tw/cp-132-4928-7e87b-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.