critical9.8Known exploited
CVE-2023-29492
Novi Survey Insecure Deserialization Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-04-13. Federal due date: 2023-05-04.
Apply updates per vendor instructions.
Impact
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| 3rdmill | Novi Survey | before 8.9.43676 |