by Kastro
Paper/Archive/CVE-2023-29492

CVE-2023-29492

novisurvey novi_survey — Novi Survey Insecure Deserialization Vulnerability

KEV · due 4 MayEPSS 3%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
97
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 85.8.858 × 2017.2Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
novi_survey< 8.9.436768.9.43676CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refnovisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspxrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492kevcisa.gov/known-exploited-vulnerabilities-catalog