go to Content

TWCERT/CC Taiwan Computer Emergency Response Team/Coordination Center



Soar Cloud System Co., Ltd. HR Portal - Arbitrary Code Execution

TVN ID TVN-202101009
CVE ID CVE-2021-22855
CVSS 9.8 (Critical)
Affected Products Soar Cloud System Co., Ltd. HR Portal version 7.3.2020.1013
Description The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.
Solution Update to version 7.3.2020.1110
Credit TsungShu Chiu
Public Date 2021-02-17