TVN ID	TVN-202409002
CVE ID	CVE-2024-8585
CVSS	6.5(Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products	Orca HCM before version 11.0
Description	Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privileges to download arbitrary system files.
Solution	Standard users, please update to version 11.0 or later. Non-standard users, please contact the vendor to install the patch.
Credit	ChunHao Yang(CHT Security)
Public Date	2024-09-09