Published: 30/01/2020 Updated: 06/02/2020
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions prior to 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

kronos web time and attendance

Mailing Lists

Kronos WebTA version 40 suffers from cross site scripting and authenticated remote privilege escalation vulnerabilities ...