6
CVSSv2

CVE-2020-8495

Published: 30/01/2020 Updated: 06/02/2020
CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Vulnerability Summary

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions prior to 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters.

Vulnerability Trend

Affected Products

Vendor Product Versions
KronosWeb Time And Attendance3.8

Mailing Lists

Kronos WebTA version 40 suffers from cross site scripting and authenticated remote privilege escalation vulnerabilities ...