This vulnerability affects lenve vhr 1.0-SNAPSHOT specifically in the HrInfoController.updateHr function within the HrMapper.xml file. Improper handling of the Password argument leads to improper privilege management, potentially allowing unauthorized privilege escalation. The vulnerability is remotely exploitable and has been publicly disclosed. The vendor was contacted but did not provide any response or remediation guidance.

Improper privilege management can allow an attacker to gain unauthorized privileges or modify sensitive information remotely. The CVSS 4.0 score of 5.3 indicates a medium impact, reflecting the potential for privilege escalation without user interaction and with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates and consider restricting access to the affected function if possible until a fix is released.