CVE-2023-39446

2023-09-1821:15:56

CWE-352

[email protected]

web.nvd.nist.gov

web application

user management

information disclosure

headers

malicious actions

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.

Affected configurations

Nvd

Node

socomecmodulys_gp_firmwareMatch01.12.10

AND

socomecmodulys_gpMatch-

VendorProductVersionCPE
socomecmodulys_gp_firmware01.12.10cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:*:*:*:*:*:*:*
socomecmodulys_gp-cpe:2.3:h:socomec:modulys_gp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
socomec	modulys_gp_firmware	01.12.10	cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:::::::*
socomec	modulys_gp	-	cpe:2.3:h:socomec:modulys_gp:-:::::::*