CVE-2023-4309

CVSS 10 CRITICALEPSS 1.1%CWE-89

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 10EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 out 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused elections and enabled web application firewall (WAF) protection for current and future elections on or around 2023-08-12.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Produtos afetados

Election Services Co. (ESC) · Internet Election Service

Referências

https://schemasecurity.co/private-elections.pdf https://www.electionservicesco.com/pages/services_internet.php https://www.youtube.com/watch?v=yeG1xZkHc64