CVE-2023-35764

2024-04-0308:15:49

CWE-345

jpcert

web.nvd.nist.gov

data verification

ip spoofing

survey maker

remote attack

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.

Affected configurations

Vulners

Node

ays_pro_pluginssurvey_makerRange<4.1.0

VendorProductVersionCPE
ays_pro_pluginssurvey_maker*cpe:2.3:a:ays_pro_plugins:survey_maker:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ays_pro_plugins	survey_maker	*	cpe:2.3:a:ays_pro_plugins:survey_maker::::::::

CNA Affected

[
  {
    "vendor": "AYS Pro Plugins",
    "product": "Survey Maker",
    "versions": [
      {
        "version": "prior to 4.1.0",
        "status": "affected"
      }
    ]
  }
]