Actively exploited · Published Apr 11, 2023 · Assigned by mitre
CVE-2023-29492
Critical 9.8 Exploited
In plain English
A critical-severity code injection in Novi Survey from Novi Survey. Attackers are actively exploiting it in the wild (listed by CISA on April 13, 2023). The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 4, 2023.
Official description
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H