CVE-2024-29837CWE-1390CWE-284

Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections

High · published April 14, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weaknesses
CWE-1390 · Weak Authentication; CWE-284 · Improper Access Control
Published
2024-04-14T23:47Z
EPSS history
Timeline
  • 14 APR 23:47Z
    Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
    cvelistv5