CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to manipulate HR profiles through the PUT /hr/info endpoint without proper authorization checks, enabling them to modify or disable accounts, including those of administrators. This could lead to significant disruptions, such as denial of service, by altering critical user information. Organizations utilizing the affected product should prioritize remediation to prevent potential exploitation by malicious insiders.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.