Published: 30/01/2020 Updated: 06/02/2020
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions prior to 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.

Vulnerability Trend

Affected Products

Vendor Product Versions
KronosWeb Time And Attendance3.8

Mailing Lists

Kronos WebTA version 40 suffers from cross site scripting and authenticated remote privilege escalation vulnerabilities ...