PT-2023-5296 · Unknown · Mod3Gp-Sy-120K

Aarón Flecha Menéndez · Published 2023-09-07 · Updated 2024-08-02 · CVE-2023-38582

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MOD3GP-SY-120K (affected versions not specified)

Description The web application of MOD3GP-SY-120K contains a persistent cross-site scripting (XSS) issue. This allows an authenticated remote attacker to inject an XSS payload into the MAIL RCV field, which will be executed when a legitimate user accesses the vulnerable page. The issue arises due to inadequate protection of the web page structure, enabling remote attackers to perform XSS attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05922

CVE-2023-38582

Affected Products

Mod3Gp-Sy-120K

References · 9

• https://osv.dev/vulnerability/CVE-2023-38582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38582 · Security Note
• https://twitter.com/CVEnew/status/1703865574994903181 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023090806 · Note
• https://t.me/cibsecurity/70679 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-250-03 · Note
• https://t.me/cvenotify/58062 · Telegram Post
• https://vuldb.com/ru/?id.239229 · Note