← CVE Intelligence

CVE-2024-29843

Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration PUBLISHED

Description (CNA)

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels

Affected (CNA)

Vendor / productVersions
CS Technologies Australia / Evolution Controlleraffected 2.x

CWE

CWE-200, CWE-284

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.