PT-2023-22103 · Hid · Hid Safe

Published 2023-06-07 · Updated 2025-01-06 · CVE-2023-2904

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions HID’s SAFE versions 5.8.0 through 5.11.3

Description The External Visitor Manager portal of HID’s SAFE is vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this issue to create a denial-of-service condition.

Recommendations For HID’s SAFE versions 5.8.0 through 5.11.3, consider disabling access to the External Visitor Manager portal until a patch is available to prevent manipulation of the visitor-id within the web API. Restrict the number of requests that can be made to the HID SAFE Web Server to minimize the risk of a denial-of-service condition.

Fix

Weakness Enumeration

CWE-471

Related Identifiers

CVE-2023-2904

Affected Products

Hid Safe

References · 6

• https://osv.dev/vulnerability/CVE-2023-2904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2904 · Security Note
• https://t.me/cvenotify/51988 · Telegram Post
• https://t.me/cibsecurity/65057 · Telegram Post
• https://t.me/cvenotify/106470 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-152-02 · Note