CVE-2025-60931

Published: Jul 29, 2026Modified: Jul 30, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://docs.offsecguy.com/cve/infor/vulnerability/insecure-direct-object-references-idor

Source: cve@mitre.org

https://docs.offsecguy.com/cve/infor/vulnerability/insecure-direct-object-references-idor

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.