CVE-2017-14680

High

Published: 21/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

ZKTeco ZKTime Web version 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document.

Risk Assessment

Attackers can gain access to confidential employee information, potentially leading to privacy breaches and data security issues within the organization.

Recommendation

It is recommended to update ZKTime Web to the latest version and implement appropriate security measures to restrict access to sensitive documents.

Other vulnerabilities in ZKTeco ZKTime Web 2.0.1.12280

CVE-2017-13129High
CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators due to lack of anti-CSRF tokens.

Original NVD description (English source)

ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS