BOLD Workplanner Insecure Direct Object Reference Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in BOLD Workplanner versions prior to 2.5.25. This vulnerability arises from insufficient validation of user input, allowing authenticated users to access functional contract details using unauthorized internal identifiers. The exposed information includes employee numbers, names, national identity numbers, clock-in records, holiday requests, and absence records, all corresponding to any employee within the company.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive employee information and functional contract details, potentially leading to misuse of personal data and violation of privacy regulations.

Remediation

Users can upgrade to BOLD Workplanner version 2.5.25 or later to address this vulnerability.