PT-2022-24576 · Zkteco · Zkteco Biotime

Ahmed Kameran · Published 2022-11-30 · Updated 2023-09-13 · CVE-2022-38803

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zkteco BioTime versions prior to 8.5.3 Build:20200816.447

Description The issue concerns Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can exploit XSS into a pdf generator when exporting data as a PDF to read local files.

Recommendations For versions prior to 8.5.3 Build:20200816.447, update to version 8.5.3 Build:20200816.447 or later to resolve the issue. As a temporary workaround, consider restricting access to the pdf generator and the export data as a PDF feature until a patch is available. Avoid using the pdf generator for exporting sensitive data until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38803

Affected Products

Zkteco Biotime

References · 6

• 🔥 https://gist.github.com/hamoshwani/44653bfe7b8cc461692a2f074b1ef475 · Exploit
• https://osv.dev/vulnerability/CVE-2022-38803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38803 · Security Note
• https://twitter.com/hamoshwani/status/1701867480577089916 · Twitter Post
• https://t.me/cibsecurity/53720 · Telegram Post
• https://zkteco.com · Note