Lucene search

IcscertCVELIST:CVE-2023-39452

HistorySep 18, 2023 - 8:01 p.m.

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

2023-09-1820:01:05

CWE-256

icscert

www.cve.org

cve-2023-39452

web application

user management

remote access

session management

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MODULYS GP (MOD3GP-SY-120K)",
    "vendor": "Socomec",
    "versions": [
      {
        "status": "affected",
        "version": "v01.12.10"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Related for CVELIST:CVE-2023-39452