Vulnerability Description
The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Learningdigital | Orca Hcm | <= 10.0 |
Related Weaknesses (CWE)
References
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-4925-86733-1.htmlThird Party Advisory
- https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-4925-86733-1.htmlThird Party Advisory
FAQ
What is CVE-2021-35965?
CVE-2021-35965 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain adminis...
How severe is CVE-2021-35965?
CVE-2021-35965 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-35965?
Check the references section above for vendor advisories and patch information. Affected products include: Learningdigital Orca Hcm.