CVE-2023-2904 - CVE House
Back to Database
Status published Unknown CVE-2023-2904

CVE-2023-2904

Vulnerability Description

The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2904

Credits & Attribution

No credits recorded in the NVD database.

References

More from HID Global

View All →
CVE-2024-23806
HID Global Reader Configuration Cards Improper Authorization
Medium 5.3
CVE-2024-22388
Insecure Default Initialization of Resource in HID Global
Medium 5.9
CVE-2021-47859
ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path
High 8.5
CVE-2018-17492
EasyLobby Solo contains default administrative credentials. An attacker could exploit...
High 8.4
CVE-2018-17491
EasyLobby Solo could allow a local attacker to gain elevated...
High 8.4

Affected Vendor

Affected Software

SAFE
Vulnerable Versions:
5.8.0

Timeline

Official Publish: June 7th, 2023
Last Modified: January 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-471

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.