CVE-2023-38952

Katalog CVE

CVSS 7.5 · High EPSS 2,7%

Kerentanan Files or Directories Accessible to External Parties pada zkteco biotime. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

Rincian

Terbit di NVD

3 Agustus 2023

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 advisory pihak ketiga
• https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py
• https://krashconsulting.com/fury-of-fingers-biotime-rce/
• https://sploitus.com/exploit?id=PACKETSTORM:177859