Vulnerability · Published Jun 26, 2024 · Assigned by VulDB
CVE-2024-6344ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in ZKBio CVSecurity V5000 from ZKTeco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZKTeco | ZKBio CVSecurity V5000 | 4.1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
References
- VDB-269733 | ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting vdb-entry, technical-description
- VDB-269733 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #358596 | ZKTeco ZKBio CVSecurity V5000 V5000 4.1.0 Stored Cross-Site Scripting third-party-advisory
- https://www.zkteco.com/en/Security_Bulletinsibs/17 related