Lucene search
430a6cef-dc26-47e3-9fa8-52fb7f19644eNVD:CVE-2024-29842HistoryApr 15, 2024 - 12:15 a.m.
CVE-2024-29842
2024-04-1500:15:14
CWE-200
CWE-284
430a6cef-dc26-47e3-9fa8-52fb7f19644e
web.nvd.nist.gov
1
web interface
evolution controller
access control
vulnerability
unauthenticated attacker
abacard field
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
Related for NVD:CVE-2024-29842