Vulnerability · Published Jun 14, 2024 · Assigned by twcert
CVE-2024-5995Soar Cloud HR Portal - Insufficient Session Expiration
High 8.8
In plain English
A high-severity security flaw in HR Portal from Soar Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 68.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Soar Cloud | HR Portal | earlier – before 7.3.2024.0409 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-7871-fecf1-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7872-1c8b4-2.html third-party-advisory