CVE-2024-35050: High severity surveyking vulnerability
Published May 14, 2024
·Updated
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.
Affected Software
2 affected components
SurveyKing SurveyKing
SurveyKing SurveyKing=1.3.1
Event History
Jan 1, 1970
CVE Published
via MITRE·12:00 AM
May 14, 2024
CVE Published
via NVD·03:39 PM
Aug 2, 2024
Data Sourced
via MITRE·03:10 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-35050?
The severity of CVE-2024-35050 is classified as a high risk vulnerability due to potential privilege escalation.
2
How do I fix CVE-2024-35050?
To fix CVE-2024-35050, ensure that session management is properly handling user sessions and revoke expired or deleted user session IDs.
3
What impact does CVE-2024-35050 have on my application?
CVE-2024-35050 allows attackers to gain unauthorized access and escalate privileges by re-using the session ID of a deleted user.
4
Is CVE-2024-35050 specific to a particular version of SurveyKing?
Yes, CVE-2024-35050 specifically affects SurveyKing version 1.3.1.
5
Can CVE-2024-35050 be exploited remotely?
Yes, CVE-2024-35050 can be exploited remotely if attackers can obtain the session ID of a deleted user.