A vulnerability was found in Kronos Web Time and Attendance 3.8.x. It has been rated as critical. Affected by this issue is an unknown code block of the component com.threeis.webta.H402editUser Servlet. The manipulation of the argument the emp_id/userid/pw1/pw2/supervisor/timekeeper as part of a Parameter leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.

The weakness was presented 01/30/2020. This vulnerability is handled as CVE-2020-8494 since 01/30/2020. The exploitation is known to be difficult. The attack may be launched remotely. The requirement for exploitation is a simple authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 4.0.0 eliminates this vulnerability.

See 149590, 149589 and 149587 for similar entries.

Productinfo

Vendor

• Kronos

Name

• Attendance
• Web Time

Version

• 3.8.x

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion