Lucene search
430a6cef-dc26-47e3-9fa8-52fb7f19644eNVD:CVE-2024-29843HistoryApr 15, 2024 - 12:15 a.m.
CVE-2024-29843
2024-04-1500:15:14
CWE-200
CWE-284
430a6cef-dc26-47e3-9fa8-52fb7f19644e
web.nvd.nist.gov
evolution controller
web interface
vulnerability
access control
unauthenticated attacker
enumeration
users
access levels
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.0%
Related for NVD:CVE-2024-29843