Description
Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Kaifa Technology | WebITR | unaffected |
|
No data.
No data available yet.
Remediation
Vendor Solution
Update to 2_1_0_23 or latest version.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-52444 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information. |
References
| Link | Providers |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html |
|
History
Mon, 14 Oct 2024 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-321 |
MITRE
Status: PUBLISHED
Assigner: twcert
Published:
Updated: 2024-10-14T03:39:11.463Z
Reserved: 2023-11-16T04:08:17.028Z
Link: CVE-2023-48392
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-12-15T10:15:07.590
Modified: 2024-11-21T08:31:37.477
Link: CVE-2023-48392
Redhat
No data.
OpenCVE Enrichment
No data.