{"id":"CVE-2024-8584","state":"PUBLISHED","title":"LEARNING DIGITAL Orca HCM - Missing Authentication","description":"Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.","publishedAt":"2024-09-09T02:57:22.560Z","updatedAt":"2025-02-21T16:54:03.087Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["LEARNING DIGITAL Orca HCM"],"affected":[{"vendor":"LEARNING DIGITAL","product":"Orca HCM","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"11.0","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-8039-24e48-1.html","https://www.twcert.org.tw/en/cp-139-8040-948ef-2.html"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8584.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8584","state":"PUBLISHED","datePublished":"2024-09-09T02:57:22.560Z","dateUpdated":"2025-02-21T16:54:03.087Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-09-09T02:28:07.857Z"},"containers":{"cna":{"title":"LEARNING DIGITAL Orca HCM - Missing Authentication","descriptions":[{"lang":"en","value":"Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in."}],"affected":[{"vendor":"LEARNING DIGITAL","product":"Orca HCM","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"11.0","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-8039-24e48-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-8040-948ef-2.html","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2025-02-17T03:24:53.774Z"},"datePublic":"2024-09-09T02:55:00.000Z","impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"  Update to version 11.0 or later"}],"value":"Update to version 11.0 or later"}],"source":{"advisory":"TVN-202409001","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"learningdigital","product":"orca_hcm","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"11.0","versionType":"custom"}],"cpes":["cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-09T13:38:38.578462Z","id":"CVE-2024-8584","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-21T16:54:03.087Z"}}]}}}