CVE-2025-60931

Received Received - Intake

IDOR in Infor Global HR v11.24.10.01.33 Exposes Employee Compensation

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: MITRE

Description

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2025-60931

Affected Vendors & Products

Vendor	Product	Version / Range
infor	global_hr	11.24.10.01.33

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in Infor Global HR v11.24.10.01.33. It allows unauthorized attackers to view other employees' compensation information by sending a specially crafted GET request to the Employee Compensation View function.

Detection Guidance

Detecting this IDOR vulnerability requires monitoring HTTP GET requests to the Employee Compensation View endpoint. Check server logs for unusual requests accessing employee compensation data without proper authorization. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests for missing or weak access controls.

Impact Analysis

Attackers could access sensitive salary and compensation data of employees without authorization. This could lead to privacy breaches, financial harm, or misuse of confidential information for competitive or malicious purposes.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if employee health-related compensation details are exposed. It breaches data protection principles requiring secure handling of sensitive information.

Mitigation Strategies

Immediately apply vendor patches or updates for Infor Global HR v11.24.10.01.33. Implement strict access controls to ensure only authorized users can view compensation data. Add input validation to prevent crafted GET requests. Monitor network traffic for suspicious activity targeting compensation endpoints.

Hi! I’m here to help you understand CVE-2025-60931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70