CVE-2023-29492 Novi Survey Insecure Deserialization
Remote attackers can execute arbitrary code on the server via the Novi Survey application, requiring an upgrade to mitigate.
- Exploited in the wild
- Since 13 Apr 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29492?
CVE-2023-29492 is a critical code injection vulnerability in n/a, published on 11 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Weakness: CWE-94
Which versions are affected by CVE-2023-29492?
It affects 1 product.
Products include 3rdmill Novi Survey.
How do I fix CVE-2023-29492?
No fix has been published for CVE-2023-29492 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 4 May 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-29492 being exploited?
Yes. Attackers have exploited CVE-2023-29492 in the wild since at least 13 Apr 2023.
Sources
Also known as GHSA-6p4p-p9hh-3hq7.