BOLD Workplanner Insecure Direct Object Reference Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in BOLD Workplanner versions prior to 2.5.25. This vulnerability arises from insufficient validation of user input, enabling an authenticated user to access detailed time records using unauthorized internal identifiers. The accessed information includes employee numbers, names, national identity numbers, clock-in records, holiday requests, and absence details for any employee within the organization.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive employee time record details, including personal identification information and attendance records, using internal identifiers that should not be accessible to the user.

Remediation

Users can upgrade to BOLD Workplanner version 2.5.25 or later to address this vulnerability.