CVE-2023-38952
Published: 03 August 2023
Summary
CVE-2023-38952 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Zkteco Biotime. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-38952 is an insecure access control vulnerability affecting ZKTeco BioTime versions through 9.0.1. The flaw stems from the application failing to validate session identifiers against user roles, which means privilege boundaries between ordinary and administrative accounts are not enforced at the server level.
An authenticated attacker can therefore issue direct HTTP requests to administrative endpoints and invoke functions that should be restricted to admins, resulting in unauthorized privilege escalation and potential exposure of sensitive data. The CVSS 7.5 score reflects network attackability with no required user interaction.
Public disclosures and proof-of-concept code have been published by Claroty and independent researchers, and the EPSS score has reached a peak of 0.2144. No vendor-supplied patches or configuration mitigations are described in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-42712
Vulnerability details
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and…
more
admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls on authorized publication limit files and directories with nonpublic data from becoming accessible to external parties.
Controlling and documenting P2P file sharing prevents files and directories from being made accessible to external parties for unauthorized distribution.
Identifying and documenting file and directory locations allows restriction of access to external parties.
Protecting backup files ensures they are not accessible to external parties or unauthorized spheres.
Sanitizing equipment before off-site maintenance reduces the risk of files or directories containing sensitive data becoming accessible to external parties.
Policy restricts media access to authorized parties only, preventing exposure of resources to external or unauthorized actors.
Media access restrictions prevent files or directories from being accessible to external parties.
Employing and evaluating controls at documented alternate sites makes files and directories less likely to be accessible to external parties through physical or environmental weaknesses.