> For the complete documentation index, see [llms.txt](https://docs.offsecguy.com/cve/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.offsecguy.com/cve/cornerstone/csod.md).

# Cornerstone OnDemand LMS v24.2.5.32 | Insecure Direct Object Reference (IDOR) Disclosures

Discoverer: Dan Gilbert, Giovanni Heward

<figure><img src="https://1271866644-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Foee2k3Tt1qG0QwCPqNSM%2Fuploads%2FexzkAXVb5PVx3n6wKles%2Fimage.png?alt=media&amp;token=8a45fd57-22ca-46c7-94f2-62c51edaf84d" alt=""><figcaption><p>Cornerstone OnDemand LMS v24.2.5.32 and prior versions</p></figcaption></figure>

## Summary of Findings

* [Insecure Direct Object Reference (IDOR) ](/cve/cornerstone/vulnerabilities/idor1.md)in <mark style="color:$danger;">LaunchVideo.aspx</mark>
  * CVE-2025-60929
* [Insecure Direct Object Reference (IDOR)](/cve/cornerstone/vulnerabilities/idor2.md) in <mark style="color:$danger;">Terminate.aspx</mark>
  * CVE-2025-60930

### Timeline

* Reported to Vendor: Oct 23rd, 2024
* Patched: TBD
* Published: TBD