CVE-2023-39452

2023-09-1821:16:04

CWE-256

[email protected]

web.nvd.nist.gov

web application

credentials storage

user management

remote access

session management

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.

Affected configurations

Nvd

Node

socomecmodulys_gp_firmwareMatch01.12.10

AND

socomecmodulys_gpMatch-

VendorProductVersionCPE
socomecmodulys_gp_firmware01.12.10cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:*:*:*:*:*:*:*
socomecmodulys_gp-cpe:2.3:h:socomec:modulys_gp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
socomec	modulys_gp_firmware	01.12.10	cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:::::::*
socomec	modulys_gp	-	cpe:2.3:h:socomec:modulys_gp:-:::::::*