Overview
Authenticated remote privilege escalation vulnerability in Kronos WebTA v3.8.x affecting
the “com.threeis.webta.H491delegate” servlet allows an attacker with Timekeeper or
Supervisor privileges to gain unauthorized administrative privileges within the
application.
This issue was reported to Kronos in accordance with responsible disclosure guidelines. Kronos responded that patches would be distributed by January and to include in the announcement that the latest version of Kronos webTA is not affected by this vulnerability. See screenshot of vendor email response below:
Vulnerability Information
Definitions
CVE Common Vulnerabilities and Exposures is a dictionary of common names (CVE Identifiers) for publicly known information security vulnerabilities maintained by the MITRE Corporation.
CVSS Common Vulnerability Scoring System is a vendor agnostic, industry open standard designed to convey the severity of a vulnerability. CVSS scores may be used to determine the urgency for update deployment within an organization and can range from 0.0 (no vulnerability) to 10.0 (critical). BlackBerry uses CVSSv3 in vulnerability assessments to present an immutable characterization of security vulnerabilities. BlackBerry assigns all relevant security vulnerabilities a non-zero score. Customers performing their own risk assessments of vulnerabilities that may impact them can benefit from using the same industry-recognized CVSS metrics.
Mitigations Mitigations are existing conditions that a potential attacker would need to overcome to mount a successful attack or that would limit the severity of an attack. Examples of such conditions include default settings, common configurations and general best practices.
Workarounds Workarounds are settings or configuration changes that a user or administrator can apply to help protect against an attack.
Acknowledgements
This vulnerability was discovered and reported by Elwood Buck and Nolan B. Kennedy of MindPoint Group. (See email screenshot at top of page in Overview section).
