Vulnerability Details : CVE-2023-29492
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Vulnerability category: Execute code
CVE-2023-29492 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Novi Survey Insecure Deserialization Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
Notes:
https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx
Added on
2023-04-13
Action due date
2023-05-04
Exploit prediction scoring system (EPSS) score for CVE-2023-29492
Probability of exploitation activity in the next 30 days: 4.45%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-29492
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2023-29492
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-29492
-
https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx
novi survey security advisory apr 2023Vendor Advisory
Products affected by CVE-2023-29492
- cpe:2.3:a:novisurvey:novi_survey:*:*:*:*:*:*:*:*