CVE-2025-44040

Katalog CVE

CVSS 7.2 · High EPSS 0,44%

Kerentanan Improper Privilege Management pada orangehrm. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise.

Rincian

Terbit di NVD

21 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hexomedin3/advisories/tree/main/CVE-2025-44040 advisory pihak ketiga
• https://github.com/orangehrm/orangehrm/releases/tag/v5.7 release notes