8.9

CVE-2023-39446

Socomec MOD3GP-SY-120K Cross-Site Request Forgery







Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Socomec ≫ Modulys Gp Firmware Version01.12.10
   Socomec ≫ Modulys Gp Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.11
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
DHS.gov 8.9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03
Third Party Advisory
US Government Resource