BOLD Workplanner Insecure Direct Object Reference Vulnerability

A Insecure Direct Object Reference (IDOR) vulnerability has been identified in BOLD Workplanner by Global Planning Solutions (GPS), affecting versions prior to 2.5.25. This vulnerability allows authenticated users to access sensitive information such as employee details and records using unauthorized internal identifiers, due to inadequate validation of user input in the general enquiry web service.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive employee information and records, including personal details and time management data.

Remediation

Users can upgrade to BOLD Workplanner version 2.5.25 to address this vulnerability.