Description
Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NesterSoft | WorkTime (on-prem/cloud) | <= 11.8.8 | — |
References
- https://r.sec-consult.com/worktime third-party-advisory