CVEvulnerability

CVE-2023-29492

9.8 CRITICAL Known exploited Published 2023-04-11 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Novi Survey Insecure Deserialization Vulnerability — Novi Survey Novi Survey

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Added to KEV
2023-04-13
Remediation due
2023-05-04
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492
Status
Analyzed
Published
2023-04-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Affected configurations

• 3rdmill novi survey (< 8.9.43676)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References