CVE-2026-39349

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39349", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T20:28:38.394Z", "datePublished": "2026-04-07T18:22:38.242Z", "dateUpdated": "2026-04-07T19:27:43.612Z"}, "containers": {"cna": {"title": "OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure", "problemTypes": [{"descriptions": [{"cweId": "CWE-326", "lang": "en", "description": "CWE-326: Inadequate Encryption Strength", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg"}], "affected": [{"vendor": "orangehrm", "product": "orangehrm", "versions": [{"version": ">= 5.0, < 5.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T18:22:38.242Z"}, "descriptions": [{"lang": "en", "value": "OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1."}], "source": {"advisory": "GHSA-g29m-3jgj-gprg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T19:27:34.699530Z", "id": "CVE-2026-39349", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T19:27:43.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T19:27:34.699530Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T19:27:39.771Z"}}], "cna": {"title": "OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure", "source": {"advisory": "GHSA-g29m-3jgj-gprg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "orangehrm", "product": "orangehrm", "versions": [{"status": "affected", "version": ">= 5.0, < 5.8.1"}]}], "references": [{"url": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg", "name": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "CWE-326: Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T18:22:38.242Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39349", "state": "PUBLISHED", "dateUpdated": "2026-04-07T19:27:43.612Z", "dateReserved": "2026-04-06T20:28:38.394Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T18:22:38.242Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "orangehrm", "vendor": "orangehrm", "versions": [{"status": "affected", "version": ">= 5.0, < 5.8.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*", "matchCriteriaId": "804C1EE9-4D17-4056-B3D6-1BDB9F0BB026", "versionEndExcluding": "5.8.1", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1."}, {"lang": "es", "value": "OrangeHRM es un sistema integral de gesti\u00f3n de recursos humanos (HRM). De 5.0 a 5.8, OrangeHRM Open Source cifra ciertos campos sensibles con AES en modo ECB, lo que preserva patrones de texto plano alineados por bloques en el texto cifrado y permite la divulgaci\u00f3n de patrones contra los datos almacenados. Esta vulnerabilidad se corrige en la versi\u00f3n 5.8.1."}], "id": "CVE-2026-39349", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39349", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T19:27:34.699530Z", "version": "2.0.3"}}]}, "published": "2026-04-07T19:16:46.067", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-g29m-3jgj-gprg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0,5.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "orangehrm", "source": "cna", "vendor": "orangehrm"}, "product": "orangehrm", "vendor": "orangehrm"}], "analysis": {"en": {"generated_at": "2026-04-10T20:54:37.128212+00:00", "value": {"mitigation_remediation": ["Apply the OrangeHRM patch to version 5.8.1 or later", "Re\u2011encrypt existing sensitive data after patching", "Restrict database access to authorized personnel only", "Audit encryption settings to confirm that AES\u2011ECB is no longer used"], "summary": {"action": "Patch promptly", "impact": "Sensitive Data Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is OrangeHRM Open Source. Versions from 5.0 up to and including 5.8 are vulnerable. Version 5.8.1 and later include a fix that replaces AES\u2011ECB with a stronger encryption mode, eliminating the pattern disclosure issue.", "description_and_impact": "OrangeHRM Open Source versions 5.0 through 5.8 use AES in ECB mode to encrypt sensitive fields. ECB mode preserves block\u2011aligned plaintext patterns in the ciphertext, which is a weakness classified as CWE\u2011326. This flaw allows an attacker who can read the encrypted data to observe repeating patterns that correspond to identical plaintext blocks, revealing structural information about the data without the need for key recovery. The result is a loss of confidentiality for fields that should remain protected, such as employee personal identifiers or credentials. The vulnerability does not provide code execution or direct system compromise; its impact is limited to pattern disclosure and potential inference of sensitive values.", "risk_and_exploitability": "The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation. OrangeHRM is not listed in the CISA KEV catalog, suggesting that this flaw is not widely exploited. Attackers would need legitimate or compromised read access to the database or application configuration to benefit from the pattern disclosure. Because the vulnerability exposes only statistical patterns and not plaintext, the immediate threat is a potential compromise of data confidentiality rather than a full system takeover. Nevertheless, in environments where sensitive employee data is stored, pattern leakage could aid in reconstructing passwords, identifiers, or other protected fields when combined with additional information."}}}}, "created": "2026-04-08T19:34:57.626652+00:00", "updated": "2026-04-13T14:26:23.554175+00:00", "vendors": ["orangehrm", "orangehrm$PRODUCT$orangehrm"]}