CVE-2021-35966
Assigner: twcert
Published: 2021-07-19T00:00:00
State: PUBLISHED
affected: product: Orca HCM
vendor: Learningdigital.com, Inc.
versions: lessThanOrEqual: 10.0
status: affected
version: unspecified
versionType: custom
datePublic: 2021-07-19T00:00:00
descriptions: value: The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
solutions: value: Update Orca HCM to version 10.9
source: advisory: TVN-202107007
discovery: EXTERNAL
title: Learningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')
x_generator: engine: Vulnogram 0.0.9