What is CVE-2023-38952?

CVE-2023-38952 is a high-severity vulnerability in Zkteco Biotime, classified under Files or Directories Accessible to External Parties. CVSS score: 7.5/10. Published 2023-08-03.

How severe is CVE-2023-38952?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Zkteco Biotime

CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege res…

EPSS: 0.024 (82.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Zkteco Biotime — versions 8.5.5
N/a — versions n/a

Weakness classification (CWE)

CWE-552 — Files or Directories Accessible to External Parties

References

af854a3a-2127-422b-91ae-364da2661108 (Product)
cve@mitre.org (Third Party Advisory)
cve@mitre.org
cve@mitre.org
134c704f-9b21-4f2e-91b3-4a467353bcc0

Frequently asked questions

What is CVE-2023-38952?: CVE-2023-38952 is a high-severity vulnerability in Zkteco Biotime, classified under Files or Directories Accessible to External Parties. CVSS score: 7.5/10. Published 2023-08-03.
How severe is CVE-2023-38952?: High severity. CVSS v3 base score is 7.5 out of 10.