9.8

CVE-2024-29836

Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cs-technologies ≫ Evolution Version <= 2.04.560
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.432
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
430a6cef-dc26-47e3-9fa8-52fb7f19644e 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
Third Party Advisory