« Volver al listado

CVE-2024-29840

Estado: AnalizadaAlta (7.5)—

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cs-technologies — Evolution

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-29840",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29840",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-22T17:32:57.011431Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "affectedData": [
        {
          "vendor": "CS Technologies Australia",
          "product": "Evolution Controller",
          "versions": [
            {
              "status": "affected",
              "version": "2.x"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:*"
          ],
          "vendor": "cs_technologies",
          "product": "evolution_controller",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.04.560.31.03.2024"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-15T00:15:13.753",
  "references": [
    {
      "url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e"
    },
    {
      "url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user\n\n"
    },
    {
      "lang": "es",
      "value": "La interfaz web de Evolution Controller, versiones 2.04.560.31.03.2024 e inferiores, contiene un control de acceso mal configurado en DESKTOP_EDIT_USER_GET_PIN_FIELDS, lo que permite que un atacante no autenticado devuelva el valor PIN de cualquier usuario."
    }
  ],
  "lastModified": "2026-06-17T07:23:13.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-technologies:evolution:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2087F49B-A37F-4472-A543-B6E6B5EA424E",
              "versionEndIncluding": "2.04.560"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "430a6cef-dc26-47e3-9fa8-52fb7f19644e"
}