CVE-2023-29492criticalunder attackCWE-94

CVE-2023-29492

Published · Updated

Follow this CVE+ Monitor Novi Survey

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 2.7%
from disclosure to weapon
Published on NVDApr 11
CISA KEV+2d
Action required by CISAfederal deadline: 2023-05-04

Apply updates per vendor instructions.

In short

Novi Survey versions before 8.9.43676 allow attackers to run malicious code on the server without needing special access. This compromises the server itself, though survey data remains protected.

Technical detail

Remote code execution vulnerability in Novi Survey < 8.9.43676 exploitable without authentication, executing arbitrary commands in the service account context. The vulnerability stems from insufficient input validation (CWE-94: Improper Control of Generation of Code), allowing unauthenticated attackers to achieve full server compromise, though the vulnerability does not extend to unauthorized access of survey responses or stored data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a