CVE-2023-48392

Kaifa Technology WebITR - Hard-coded Cryptographic Key

State: Published
Severity: 9.8 Critical
Published: Dec 15, 2023
Updated: Oct 14, 2024
Reserved: Nov 16, 2023

Description

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key

Affected Products

Product	Versions
WebITRKaifa Technology	2_1_0_19Affected

References

https://www.twcert.org.tw/tw/cp-132-7622-57e5f-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.