Lucene search

Cisa-cgCVE-2023-4309

HistoryOct 10, 2023 - 6:15 p.m.

CVE-2023-4309

2023-10-1018:15:19

CWE-89

cisa-cg

web.nvd.nist.gov

esc

internet election service

sql injection

vulnerability

waf

web application firewall

nvd

cve-2023-4309

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.

Affected configurations

Nvd

Node

electionservicescointernet_election_serviceMatch-

VendorProductVersionCPE
electionservicescointernet_election_service-cpe:2.3:a:electionservicesco:internet_election_service:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
electionservicesco	internet_election_service	-	cpe:2.3:a:electionservicesco:internet_election_service:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Internet Election Service",
    "vendor": "Election Services Co. (ESC)",
    "versions": [
      {
        "lessThanOrEqual": "2023-08-12",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

schemasecurity.co/private-elections.pdf

www.electionservicesco.com/pages/services_internet.php

www.youtube.com/watch?v=yeG1xZkHc64

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

Related for CVE-2023-4309