What is CVE-2023-2904?

CVE-2023-2904 is a high-severity vulnerability in Hid Global Safe, classified under Modification of Assumed-Immutable Data (MAID). CVSS score: 7.3/10. Published 2023-06-07.

How severe is CVE-2023-2904?

High severity. CVSS v3 base score is 7.3 out of 10.

Vulnerability in Hid Global Safe

CVE-2023-2904

The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.

EPSS: 0.006 (44.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H.

Affected products

Hid Global Safe — versions 5.8.0
Hidglobal Safe

Weakness classification (CWE)

CWE-471 — Modification of Assumed-Immutable Data (MAID)

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, government-resource)

Frequently asked questions

What is CVE-2023-2904?: CVE-2023-2904 is a high-severity vulnerability in Hid Global Safe, classified under Modification of Assumed-Immutable Data (MAID). CVSS score: 7.3/10. Published 2023-06-07.
How severe is CVE-2023-2904?: High severity. CVSS v3 base score is 7.3 out of 10.