CVE-2023-38952
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.66% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-552
- Affected
- zkteco/biotime
- Source
- cve@mitre.org
References
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38952Third Party Advisory
- https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py
- https://krashconsulting.com/fury-of-fingers-biotime-rce/
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38952Third Party Advisory
- https://sploitus.com/exploit?id=PACKETSTORM:177859
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.