Threats tagged 'ghsa-pw58-qr35-gpr4'

A critical vulnerability exists in the human resources component of Roskus Prospero Flow CRM versions before 5.15.9. The issue involves hard-coded credentials where the employee save controller defaults to the literal password "changeme" during onboarding, allowing unauthenticated remote attackers to authenticate as any employee if they know the employee's email address. This occurs because the onboarding form does not require a password field, enabling attackers to bypass authentication controls.