What is CVE-2020-14982?

CVE-2020-14982 is a medium-severity vulnerability in Kronos Web Time And Attendance, classified under SQL Injection. CVSS score: 6.5/10. Published 2020-07-15.

How severe is CVE-2020-14982?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Kronos Web Time And Attendance

CVE-2020-14982

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database.

Vulnerability class: SQL Injection

EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Kronos Web_time_and_attendance
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-14982?: CVE-2020-14982 is a medium-severity vulnerability in Kronos Web Time And Attendance, classified under SQL Injection. CVSS score: 6.5/10. Published 2020-07-15.
How severe is CVE-2020-14982?: Medium severity. CVSS v3 base score is 6.5 out of 10.