What is the CVSS score of EUVD-2025-17098?

EUVD-2025-17098 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Hr Portal are affected by EUVD-2025-17098?

CVE-2025-48784 is an authorization bypass in Soar Cloud HRD that allows attackers to modify system settings without credentials, potentially compromising HR data integrity, employee records, and…

How to fix or mitigate EUVD-2025-17098?

Within 24 hours: Identify all systems running Soar Cloud HRD versions through 7.3.2025.0408 and restrict network access to administrative interfaces where possible. Within 7 days: Implement compensating controls (WAF rules blocking unauthorized settings modifications, enable audit logging for all system configuration changes, and segment HRD systems from general network access). Within 30 days: Contact vendor for patch availability and timeline; evaluate alternative HRD platforms if patch is unavailable and risk profile is unacceptable.

Hr Portal EUVD-2025-17098

| CVE-2025-48784 HIGH

Missing Authorization (CWE-862)

2025-06-06 ART@zuso.ai

Information Disclosure Hr Portal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17098

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 10:15 nvd

HIGH 7.5

DescriptionCVE.org

A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to modify system settings without prior authorization.

AnalysisAI

Missing authorization vulnerability in Soar Cloud HRD Human Resource Management System versions up to 7.3.2025.0408 that allows unauthenticated remote attackers to modify critical system settings without any credentials or user interaction. This is a high-severity integrity violation (CVSS 7.5) affecting HR management infrastructure; attackers can alter configurations that may impact payroll, employee records, access controls, and compliance functions. No exploitation complexity is required (AC:L, PR:N), making this vulnerability immediately exploitable in real-world environments.

Technical ContextAI

The vulnerability stems from a missing authorization check (CWE-862: Missing Authorization) in the Soar Cloud HRD application's system settings modification endpoints. CWE-862 indicates the application fails to verify whether a user has the requisite permissions before processing sensitive state-change operations. In typical HR/HRM systems, settings endpoints control configurations like user roles, system parameters, data retention policies, and integration credentials—all critical functions that should be restricted to authenticated administrators. The affected product is Soar Cloud HRD (a cloud-hosted human resource management system), specifically versions through 7.3.2025.0408. Without proper authorization validation at the application layer, any network-accessible endpoint that modifies system state is exposed to unauthenticated modification. This is a classic improper access control issue common in rapidly-developed SaaS platforms where authorization logic is either omitted or incorrectly implemented.

RemediationAI

action: Immediate Patching; details: Upgrade Soar Cloud HRD to version 7.3.2025.0409 or later (based on version numbering pattern, the next patch version should address this). Contact Soar Cloud support for emergency security updates if available.
action: Network Segmentation; details: Restrict network access to Soar Cloud HRD administrative and settings endpoints using WAF (Web Application Firewall) rules or API gateway policies. Implement IP whitelisting for system configuration endpoints to trusted internal networks only.
action: Authorization Hardening; details: Pending vendor patch, implement reverse-proxy or API gateway middleware to enforce role-based access control (RBAC) on all settings modification endpoints. Verify that requests include valid authentication tokens and that tokens are mapped to administrator roles before allowing state-change operations.
action: Audit and Monitoring; details: Enable detailed logging of all system settings modification attempts, including failed and successful requests. Monitor for unauthorized changes to critical HR system configurations, user roles, or integration credentials. Review audit logs from the vulnerability disclosure date backward.
action: Vendor Advisory; details: Check Soar Cloud's official security advisory portal and subscribe to their security mailing list for patch availability notices. Request formal confirmation of patch release timelines if not yet available.