PT-2023-5301 · Unknown · Modulys Gp

Aarón Flecha Menéndez · Published 2023-09-07 · Updated 2024-08-02 · CVE-2023-39452

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MODULYS GP (MOD3GP-SY-120K) (affected versions not specified)

Description The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application. This issue is related to the storage of passwords in plaintext. An attacker can exploit this to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-256

Related Identifiers

BDU:2023-05927

CVE-2023-39452

Affected Products

Modulys Gp

References · 11

• https://osv.dev/vulnerability/CVE-2023-39452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39452 · Security Note
• https://bdu.fstec.ru/vul/2023-05927 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023090806 · Note
• https://t.me/cibsecurity/70684 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-250-03 · Note
• https://twitter.com/cracbot/status/1704012498624811159 · Twitter Post
• https://t.me/cvenotify/58326 · Telegram Post
• https://vuldb.com/ru/?id.239234 · Note
• https://twitter.com/CVEnew/status/1703865577050190186 · Twitter Post
• https://t.me/cvenotify/58057 · Telegram Post