CVE-2020-8495

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters.

• CWE-862

• http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://www.nolanbkennedy.com/post/privilege-escalation-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory
• http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://www.nolanbkennedy.com/post/privilege-escalation-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8487Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8488Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8489Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.…6.5
• CVE-2020-8493A stored XSS vulnerability in Kronos Web Time and Attendance…4.8
• CVE-2020-8494In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…8.8
• CVE-2020-8496In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.…4.8
• CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attac…5.3
• CVE-2020-8498XSS exists in the shortcode functionality of the GistPress p…5.4
• CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbi…7.2
• CVE-2020-8503Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 …6.5
• CVE-2020-8504School Management Software PHP/mySQL through 2019-03-14 allo…6.5