CVE-2024-6344: ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3R or above". This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZKTeco ZKBio CVSecurity V5000to a version that resolves this vulnerability.Fixed in ZKBio CVSecurity V6600 6.1.3_R or above
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6344?
CVE-2024-6344 is classified as problematic due to the potential for cross-site scripting vulnerabilities.
How do I fix CVE-2024-6344?
To fix CVE-2024-6344, ensure that the software ZKTeco ZKBio CVSecurity V5000 is updated to the latest patched version.
What component is affected by CVE-2024-6344?
CVE-2024-6344 affects the Push Configuration Section of the ZKTeco ZKBio CVSecurity V5000.
What kind of attack can CVE-2024-6344 facilitate?
CVE-2024-6344 can facilitate cross-site scripting (XSS) attacks due to improper handling of the Configuration Name argument.
Is CVE-2024-6344 a local or remote vulnerability?
CVE-2024-6344 is a remote vulnerability that can be exploited by attackers to execute scripts in the context of a user’s browser.