CVE-2023-29492

critical

Description

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492

https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33059

Details

Source: Mitre, NVD

Published: 2023-04-11

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H