CVE-2021-35965: Learningdigital.com, Inc. Orca HCM, заобикаляне на

Описание

Оригинално описание

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in.

Засегнати продукти

• Learningdigital.com, Inc. Orca HCM: unspecified до 10.0

Вид слабост

• CWE-522 Недостатъчно защитени удостоверителни данни

История

Други уязвимости в Learningdigital.com, Inc. Orca HCM

• 4.3CVE-2021-35968
• 5.3CVE-2021-35967
• 6.1CVE-2021-35966
• 7.3CVE-2021-35964
• 9.8CVE-2021-35963

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-35965
• https://nvd.nist.gov/vuln/detail/CVE-2021-35965
• https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
• https://www.twcert.org.tw/tw/cp-132-4925-86733-1.html