« Volver al listado

CVE-2024-29839

Estado: AnalizadaAlta (7.5)—

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cs-technologies — Evolution

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-29839",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29839",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-22T17:34:08.350427Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "affectedData": [
        {
          "vendor": "CS Technologies Australia",
          "product": "Evolution Controller",
          "versions": [
            {
              "status": "affected",
              "version": "2.x"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:*"
          ],
          "vendor": "cs_technologies",
          "product": "evolution_controller",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.04.560.31.03.2024"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-15T00:15:13.533",
  "references": [
    {
      "url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e"
    },
    {
      "url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user\n\n"
    },
    {
      "lang": "es",
      "value": "La interfaz web de Evolution Controller, versiones 2.04.560.31.03.2024 e inferiores, contiene un control de acceso mal configurado en DESKTOP_EDIT_USER_GET_CARD, lo que permite que un atacante no autenticado devuelva los datos del valor de la tarjeta de cualquier usuario."
    }
  ],
  "lastModified": "2026-06-17T07:23:13.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cs-technologies:evolution:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2087F49B-A37F-4472-A543-B6E6B5EA424E",
              "versionEndIncluding": "2.04.560"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "430a6cef-dc26-47e3-9fa8-52fb7f19644e"
}