PT-2022-24382 · Suprema · Suprema Biostar 2

Published 2022-09-19 · Updated 2025-05-29 · CVE-2022-38351

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Suprema BioStar (aka Bio Star) 2 version 2.8.16

Description A vulnerability in the software allows attackers to escalate privileges to System Administrator via a crafted PUT request to the "update profile page" API endpoint. This issue enables attackers to gain elevated access, potentially leading to further malicious activities.

Recommendations For Suprema BioStar (aka Bio Star) 2 version 2.8.16, as a temporary workaround, consider restricting access to the update profile page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-38351

Affected Products

Suprema Biostar 2

References · 6

• 🔥 https://nobugescapes.com/blog/privilege-escalation-from-user-operator-to-system-administrator · Exploit
• 🔥 https://nobugescapes.com/wp-content/uploads/2022/08/Part1.docx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38351 · Security Note
• https://t.me/cibsecurity/50092 · Telegram Post
• https://t.me/cvenotify/36596 · Telegram Post
• https://t.me/cvenotify/123997 · Telegram Post