CVE-2020-8494 - CVE House
Back to Database
Status published High CVE-2020-8494

In Kronos Web Time and Attendance (webTA) 3.8.x and later...

Vulnerability Description

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-8494

Credits & Attribution

No credits recorded in the NVD database.

References

More from kronos

View All →
CVE-2020-8496
In Kronos Web Time and Attendance (webTA) 4.1.x and later...
Medium 6.9
CVE-2020-8495
In Kronos Web Time and Attendance (webTA) 3.8.x and later...
High 7.5
CVE-2020-8493
A stored XSS vulnerability in Kronos Web Time and Attendance...
Medium 6.9
CVE-2020-35604
An XXE attack can occur in Kronos WebTA 5.0.4 when...
Critical 9.8
CVE-2020-14982
A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and...
Medium 6.5

Affected Vendor

Affected Software

web time and attendance
Vulnerable Versions:
3.8

Timeline

Official Publish: January 30th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.