LEARNING DIGITAL Orca HCM - Missing Authentication
Priority MEDIUM 50CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Fixed Orca HCM (LEARNING DIGITAL): 11.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Learningdigital.com, Inc. | Orca HCM | before 11.0 | 11.0 | Patch available | CNA |
- Orca HCM VendorLearningdigital.com, Inc. Affected before 11.0 Fixed in 11.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* | before 11.0 | Vulnerable | Learningdigital.com, Inc. |
- cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* Versions before 11.0 Vulnerable ·Learningdigital.com, Inc.
Remediation
- Fix · CNA Orca HCM (LEARNING DIGITAL) Fixed in 11.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
LEARNING DIGITAL Orca HCM 11.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-07961 LEARNING DIGITAL Orca HCM - Arbitrary File DownloadPriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8584
- 2026-10-03 Alias added: GHSA-c2qc-w934-qc22
References
More Learningdigital.com, Inc. Orca Hcm vulnerabilities
- TI-2025-01191 Learning Digital Orca HCM - Improper Authentication CVSS 3.1CRITICAL 9.8
- TI-2021-14418 Learningdigital.com, Inc. Orca HCM - Hard-code password CVSS 3.1CRITICAL 9.8
- TI-2021-14416 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
- TI-2021-14417 Learningdigital.com, Inc. Orca HCM - Broken Authentication CVSS 3.1CRITICAL 9.8
- TI-2025-01193 Learning Digital Orca HCM - SQL Injection CVSS 3.1HIGH 8.8
- TI-2025-01192 Learning Digital Orca HCM - Arbitrary File Upload CVSS 3.1HIGH 8.8
Sources
- CVE-2024-8584 · CVE Program
- CVE-2024-8584 · NVD
- FIRST EPSS
- GHSA-c2qc-w934-qc22 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences