CVE-2019-15130 - CVE House
Back to Database
Status published Critical CVE-2019-15130

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681...

Vulnerability Description

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-15130

Credits & Attribution

No credits recorded in the NVD database.

References

More from humanica

View All →
CVE-2019-16106
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681...
High 7.5
CVE-2019-15129
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681...
Medium 5.3
CVE-2019-14932
The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203...
High 7.5

Affected Vendor

Affected Software

humatrix 7
Vulnerable Versions:
1.0.0.203, 1.0.0.681

Timeline

Official Publish: August 18th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.