[ CVE-2023-29492 · Published 11 Apr 2023 ]
Novi Survey Insecure Deserialization Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 3%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-04-13
- Critical severity: CVSS 9.8
[ Description ]Official description
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
CISA: Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 4 May 2023): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspxVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource