CVE-2020-8494: Authenticated Remote Privilege Escalation in Kronos Web Time and Attendance (webTA)

Overview

Authenticated remote privilege escalation vulnerability in Kronos WebTA v3.8.x affecting

the “com.threeis.webta.H402editUser” servlet allows an attacker with Timekeeper,

Master Timekeeper, or HR Admin privileges to gain unauthorized administrative

privileges within the application.

This issue was reported to Kronos in accordance with responsible disclosure guidelines. Kronos responded that patches would be distributed by January and to include in the announcement that the latest version of Kronos webTA is not affected by this vulnerability. See screenshot of vendor email response below:

Kronos Email Response

Vulnerability Information

Definitions

CVE  Common Vulnerabilities and Exposures is a dictionary of common names (CVE Identifiers) for publicly known information security vulnerabilities maintained by the MITRE Corporation. 

CVSS  Common Vulnerability Scoring System is a vendor agnostic, industry open standard designed to convey the severity of a vulnerability. CVSS scores may be used to determine the urgency for update deployment within an organization and can range from 0.0 (no vulnerability) to 10.0 (critical). BlackBerry uses CVSSv3 in vulnerability assessments to present an immutable characterization of security vulnerabilities. BlackBerry assigns all relevant security vulnerabilities a non-zero score. Customers performing their own risk assessments of vulnerabilities that may impact them can benefit from using the same industry-recognized CVSS metrics. 

Mitigations    Mitigations are existing conditions that a potential attacker would need to overcome to mount a successful attack or that would limit the severity of an attack. Examples of such conditions include default settings, common configurations and general best practices. 

Workarounds  Workarounds are settings or configuration changes that a user or administrator can apply to help protect against an attack.  

Acknowledgements

This vulnerability was discovered and reported by Elwood Buck and Nolan B. Kennedy of MindPoint Group. (See email screenshot at top of page in Overview section).