CVE-2017-13129

High

Published: 26/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators due to lack of anti-CSRF tokens.

Risk Assessment

The organization may be exposed to unauthorized changes in administrator privileges, potentially leading to serious security breaches.

Recommendation

It is recommended to implement anti-CSRF tokens in the application and review existing user permissions to minimize risk.

Other vulnerabilities in ZKTeco ZKTime Web 2.0.1.12280

CVE-2017-14680High
ZKTeco ZKTime Web version 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document.

Original NVD description (English source)

Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS