CVE-2024-5995: Soar Cloud HR Portal - Insufficient Session Expiration

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-613

Description

The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused.

Affected products

Soar Cloud Ltd. HR Portal: before 7.3.2024.0409 — fixed in 7.3.2024.0409

How to fix

Upgrade to a fixed version: Soar Cloud Ltd. HR Portal 7.3.2024.0409. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-7872-1c8b4-2.html
https://www.twcert.org.tw/tw/cp-132-7871-fecf1-1.html
https://www.twcert.org.tw/en/cp-139-7872-1c8b4-2.html
https://www.twcert.org.tw/tw/cp-132-7871-fecf1-1.html

Get alerted when CVE-2024-5995 or the next vulnerability affects your stack