ZKTeco BioTime v8.5.5 - Path Traversal

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. id: CVE-2023-38950 info: name: ZKTeco BioTime v8.5.5 - Path Traversal author: iamnoooob,pdresearch severity: high description: | A pa...

CVE-2023-38950

creationtimestamp| type| source ---|---|--- 2025-05-05 17:48:55+00:00| seen| https://t.me/truesecator/7008 2025-05-05 18:01:11+00:00| seen| https://t.me/icscert/1143 2025-05-06 21:02:15+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lojrr7vhqw2e 2025-05-19 18:00:15+00:00|...

CVE-2023-38950

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime...

CVE-2023-38950

ZKTeco BioTime v8.5.5 is affected by a path traversal vulnerability in the iclock API that allows unauthenticated attackers to read arbitrary files by supplying a crafted payload. This is due to insufficient path validation in the iclock API parameter handling. The issue is fixed in ZKBioTime ver...