CVE-2024-32499
CVE-2024-32499 is a medium-severity vulnerability in Newforma Project Center with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.
Key facts
- Severity: Medium (CVSS 3.x base score 4.9)
- EPSS exploit prediction: 0% (30th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-30301
- Weakness: CWE-94
- Affected product: Newforma Project Center
- Published:
- Last modified:
Description
Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.
Frequently asked questions
- What is CVE-2024-32499?
- Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed.
- How severe is CVE-2024-32499?
- CVE-2024-32499 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2024-32499 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-32499?
- CVE-2024-32499 affects Newforma Project Center. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-32499?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-32499 have an EU (EUVD) identifier?
- Yes. CVE-2024-32499 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-30301.
- When was CVE-2024-32499 published?
- CVE-2024-32499 was published on 2025-04-28 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:newforma:project_center:*:*:*:*:*:*:*:*
More vulnerabilities in Newforma Project Center
- CVE-2025-35051 — Critical (CVSS 9.8): Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp,…
- CVE-2025-35050 — Critical (CVSS 9.8): Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote,…
- CVE-2025-35055 — High (CVSS 8.8): Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an…
- CVE-2025-35053 — Medium (CVSS 6.4): Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the…
- CVE-2025-35061 — Medium (CVSS 5.9): Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker…
- CVE-2025-35058 — Medium (CVSS 5.9): Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause…
All CVEs affecting Newforma Project Center →
Other CWE-94 (Code Injection) vulnerabilities
- CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
- CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
- CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
- CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
- CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
- CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.