CVE-2019-18626

MEDIO 4.3CVE-2019-18626 · Published 25/03/2020 · updated 17/06/2026

In breve

CVE-2019-18626 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda ormed mis (harriscomputer).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.62%, superiore al 49.8% delle vulnerabilità.
Correzione: aggiornare a 2019.1.4 o successiva.

Package	Affected versions	Patched versions
ormed mis harriscomputer	`< 2019.1.4`	`2019.1.4`

Description

Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social security numbers, home addresses, and more.

References

fireeye/Vulnerability-Disclosures · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free