8.8
CVE-2024-29837
- EPSS 0.2%
- Veröffentlicht 15.04.2024 00:15:13
- Zuletzt bearbeitet 10.12.2025 17:37:33
- Quelle 430a6cef-dc26-47e3-9fa8-52fb7f
- CVE-Watchlists
- Unerledigt
LoginThe Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cs-technologies ≫ Evolution Version <= 2.04.560
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.422 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 430a6cef-dc26-47e3-9fa8-52fb7f19644e | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-1390 Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.