Code injection

UNSUPPPORTED WHEN ASSIGNED The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39446

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-38582

Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of the web application, the X...

Cross site scripting

UNSUPPPORTED WHEN ASSIGNED Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the we...

CVE-2023-41084

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-41965

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process...

CVE-2023-41084

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-41965

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process...

CVE-2023-40221

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section MAIL SERVER where the information is displayed. Injection can be done on...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section MAIL SERVER where the information is displayed...

Authentication flaw

UNSUPPPORTED WHEN ASSIGNED Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process...

Code injection

UNSUPPPORTED WHEN ASSIGNED Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device...

CVE-2023-38582

MOD3GP-SY-120K (MODULYS GP) web firmware v01.12.10 is affected by a persistent cross-site scripting (XSS) flaw in the MAIL_RCV field that allows an authenticated remote attacker to inject arbitrary JavaScript, executed when a user loads the vulnerable page. Affected product is the MOD3GP-SY-120K ...

CVE-2023-38582 Socomec MOD3GP-SY-120K Cross-site Scripting

Persistent cross-site scripting XSS in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAILRCV. When a legitimate user attempts to access to the vulnerable page of the web application, the X...

CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-39446

The CVE-2023-39446 CSRF issue affects the Socomec MODULYS GP family web firmware (MOD3GP-SY-120K). Root cause: weaknesses in the web app’s user management allow an attacker to obtain header information to craft specially designed URLs and trigger actions when a legitimate user is logged in. Impac...

CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application...

CVE-2023-39452

CVE-2023-39452 affects Socomec MODULYS GP (MOD3GP-SY-120K) web interface. Public documents identify plaintext storage of passwords in the user management section and remote credential exposure due to improper session handling. Affected product details cited by CISA ICS advisory (MODULYS GP-SY-120...