Beveiligingsadvies

CVE-2023-38952

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2023-08-03 00:00:00

Laatst bijgewerkt 2026-07-09 00:27:20

Toegewezen door mitre

CVSS-score 7.5

Status PUBLISHED

Beschrijving

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

← Alle CVE's bekijken Bekijk op cve.org ↗