Lucene search
430a6cef-dc26-47e3-9fa8-52fb7f19644eNVD:CVE-2024-29837HistoryApr 15, 2024 - 12:15 a.m.
CVE-2024-29837
2024-04-1500:15:13
CWE-1390
CWE-284
430a6cef-dc26-47e3-9fa8-52fb7f19644e
web.nvd.nist.gov
3
web interface
evolution controller
session management
unauthenticated attacker
administrator functionality
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0
Percentile
9.0%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0
Percentile
9.0%
Related for NVD:CVE-2024-29837