CVE-2023-4309

CVSS 10 CRITICALEPSS 1.1%CWE-89

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 10EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 oct 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Productos afectados

Election Services Co. (ESC) · Internet Election Service

Referencias

https://schemasecurity.co/private-elections.pdf https://www.electionservicesco.com/pages/services_internet.php https://www.youtube.com/watch?v=yeG1xZkHc64