CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
mitreCNA
---
---
CISA-ADPADP
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
zktecozkbio_cvsecurity
6.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35428.md
https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35428.md