What is the CVSS score of CVE-2024-29836?

CVE-2024-29836 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Evolution CVE-2024-29836

CRITICAL

Improper Access Control (CWE-284)

2024-04-15 430a6cef-dc26-47e3-9fa8-52fb7f19644e

Authentication Bypass Evolution

9.8

CVSS 3.1 · Vendor: 430a6cef-dc26-47e3-9fa8-52fb7f19644e

Severity by source

Vendor (430a6cef-dc26-47e3-9fa8-52fb7f19644e) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (430a6cef-dc26-47e3-9fa8-52fb7f19644e) · only source for this CVE.

CVSS VectorVendor: 430a6cef-dc26-47e3-9fa8-52fb7f19644e

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Apr 15, 2024 - 00:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.

AnalysisAI

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site. Affected products include: Cs-Technologies Evolution.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.