Vulnerabilities > CVE-2023-38952 - Files or Directories Accessible to External Parties vulnerability in Zkteco Biotime 8.5.5

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
zkteco
CWE-552
NVD
Published: 2023-08-03
Updated: 2025-05-27

Summary

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

Vulnerable Configurations

Part Description Count
Application
Zkteco
1

Common Weakness Enumeration (CWE)

References