Description
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user's account.
Unscored
CVE-2022-27108
EUVD-2022-31647GHSA-729r-q9xr-m8j5
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any …
Published Apr 6, 2022 · Updated Aug 3, 2024 · Assigned by mitre