What is CVE-2023-48392?

CVE-2023-48392 is a critical-severity vulnerability in Kaifa Webitr Attendance System, classified under Use of Hard-coded Cryptographic Key. CVSS score: 9.8/10. Published 2023-12-15.

How severe is CVE-2023-48392?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-48392 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Kaifa Webitr Attendance System

CVE-2023-48392

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.

EPSS: 0.006 (43.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Kaifa Webitr_attendance_system — versions 2.1.0.23
Kaifa Technology Webitr — versions 2_1_0_19

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

twcert@cert.org.tw (Third Party Advisory)

Frequently asked questions

What is CVE-2023-48392?: CVE-2023-48392 is a critical-severity vulnerability in Kaifa Webitr Attendance System, classified under Use of Hard-coded Cryptographic Key. CVSS score: 9.8/10. Published 2023-12-15.
How severe is CVE-2023-48392?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-48392 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.