Lucene search
HistoryNov 30, 2022 - 2:15 p.m.
CVE-2022-38803
zkteco biotime
access control
vulnerability
authenticated employee
pdf generator
local files
xss exploit
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
29.1%
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
Affected configurations
Node
zktecobiotimeRange<8.5.4
Related
cvelist
cvelist
CVE-2022-38803
2022-11-30 00:00:00
cve
cve
CVE-2022-38803
2022-11-30 14:15:10
prion
prion
Improper access control
2022-11-30 14:15:00
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
29.1%
Related for NVD:CVE-2022-38803