CVE-2023-2904
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Jun 7, 2023
Updated: Jan 6, 2025
CWE ID 78
Summary
CVE-2023-2904 affects the External Visitor Manager portal of HID's SAFE versions 5.8.0 through 5.11.3. An attacker can manipulate web fields in the application programmable interface (API) to log in using valid account credentials obtained through internal user requests. After gaining access, the attacker can manipulate visitor-ids to access the personal data of other users. There is no limit to the number of requests, allowing potential denial-of-service conditions.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- OX App Suite
Affected Vendors
- Open-xchange