CVE-2017-13129

Severity: high (CVSS 8.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-26 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens.

Affected products

ZKTeco Zktime Web: 2.0.1.12280

References

http://seclists.org/bugtraq/2017/Sep/19
http://seclists.org/fulldisclosure/2017/Sep/38
http://seclists.org/bugtraq/2017/Sep/19
http://seclists.org/fulldisclosure/2017/Sep/38

Get alerted when CVE-2017-13129 or the next vulnerability affects your stack