Skip to content
OpenAdvisories
Critical ICSA-23-250-03 7 CVEs

Socomec MOD3GP-SY-120K

Published Sep 7, 2023 · Updated Sep 7, 2023

Vendor: Socomec Product: MODULYS GP (MOD3GP-SY-120K)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute malicious Javascript code, obtain sensitive information, or steal session cookies.

Vulnerabilities 7

  • Critical 10.0
    CVE-2023-41084

    Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking

    Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • High 8.9
    CVE-2023-39446

    Socomec MOD3GP-SY-120K Cross-Site Request Forgery

    Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged …

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • High 8.8
    CVE-2023-40221

    Socomec MOD3GP-SY-120K Code Injection

    The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information …

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • High 7.5
    CVE-2023-39452

    Socomec MOD3GP-SY-120K Plaintext Storage of a Password

    The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • High 7.5
    CVE-2023-41965

    Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information

    Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • Medium 6.5
    CVE-2023-38255

    Socomec MOD3GP-SY-120K Cross-site Scripting

    A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.

    Socomec MODULYS GP (MOD3GP-SY-120K)
  • Medium 6.3
    CVE-2023-38582

    Socomec MOD3GP-SY-120K Cross-site Scripting

    Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vuln…

    Socomec MODULYS GP (MOD3GP-SY-120K)

Revision history

  1. #1

    Initial Publication

References