CVE-2023-29492 — Novi Survey Insecure Deserialization Vulnerability

provenance: imported · CVE: CVE-2023-29492

CVE-2023-29492: Novi Survey Insecure Deserialization Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Novi Survey
Product	Novi Survey
Date added	2023-04-13
Due date	2023-05-04
Ransomware campaign use	Unknown

Description

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-29492
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog