PT-2023-5301 · Unknown · Modulys Gp

Aarón Flecha Menéndez · CVE-2023-39452 · Publicado 2023-09-07 · Atualizado 2024-08-02

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MODULYS GP (MOD3GP-SY-120K) (affected versions not specified)

Description The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application. This issue is related to the storage of passwords in plaintext. An attacker can exploit this to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-256

Identificadores relacionados

BDU:2023-05927

CVE-2023-39452

Produtos afetados

Modulys Gp

Referências · 11

• https://cybersecurity-help.cz/vdb/SB2023090806 · Nota
• https://osv.dev/vulnerability/CVE-2023-39452 · Aviso do Fabricante
• https://t.me/cibsecurity/70684 · Publicação no Telegram
• https://cisa.gov/news-events/ics-advisories/icsa-23-250-03 · Nota
• https://twitter.com/cracbot/status/1704012498624811159 · Publicação no Twitter
• https://t.me/cvenotify/58326 · Publicação no Telegram
• https://vuldb.com/ru/?id.239234 · Nota
• https://twitter.com/CVEnew/status/1703865577050190186 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39452 · Nota de Segurança
• https://t.me/cvenotify/58057 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-05927 · Nota de Segurança