PT-2022-20152 · Zkteco · Zkteco Biotime

Dimitri Lesy · Published 2022-11-08 · Updated 2022-11-09 · CVE-2022-30515

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.4

Description The issue is related to missing authentication on folders containing employee photos. This allows an attacker to view the photos through filename enumeration.

Recommendations For ZKTeco BioTime version 8.5.4, consider implementing proper authentication mechanisms for the folders containing employee photos to prevent unauthorized access. As a temporary workaround, restrict access to these folders until a proper fix is applied.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-30515

Affected Products

Zkteco Biotime

References · 6

• 🔥 https://codingkoala.eu/posts/CVE202230515 · Exploit
• https://osv.dev/vulnerability/CVE-2022-30515 · Vendor Advisory
• https://zkteco.me/software-5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30515 · Security Note
• https://t.me/cibsecurity/52697 · Telegram Post
• https://t.me/cvenotify/37338 · Telegram Post