CVE-2021-35968mediumCWE-22

CVE-2021-35968: medium-severity vulnerability in Learningdigital.com, Inc. Orca HCM

Learningdigital.com, Inc. Orca HCM - Path Traversal-2

Published · Updated

Follow this CVE+ Monitor Orca HCM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 1.0%
The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Learningdigital.com, Inc. · Orca HCM
Related CVEs — Learningdigital.com, Inc. Orca HCM

In the same product, most dangerous first.

CVE-2021-35963CRITICALLearningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous TypeEPSS 2.4%CVE-2021-35965CRITICALLearningdigital.com, Inc. Orca HCM - Hard-code passwordEPSS 2.4%CVE-2021-35967MEDIUMLearningdigital.com, Inc. Orca HCM - Path Traversal-1EPSS 1.3%CVE-2021-35964HIGHLearningdigital.com, Inc. Orca HCM - Broken AuthenticationEPSS 1.1%CVE-2021-35966MEDIUMLearningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.8%