CVE-2023-2904

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-471

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290436.1Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed w CVE-2023-290445.4Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation CVE-2023-290455.4Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be CVE-2023-290464.3Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectio CVE-2023-290477.3Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrar CVE-2023-290488.8A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged run CVE-2023-290496.1The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised CVE-2023-29058.8Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an CVE-2023-290509.6The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside CVE-2023-290518.1User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the CVE-2023-290525.4Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attack CVE-2023-290537.8A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0). The affected application