PT-2023-5302 · Unknown · Modulys Gp

Aarón Flecha Menéndez · Published 2023-09-07 · Updated 2024-08-02 · CVE-2023-38255

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MODULYS GP (MOD3GP-SY-120K) (affected versions not specified)

Description The issue exists due to a lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting (XSS) attacks. This could enable an attacker, with or without access to the device, to include malicious code when uploading new device configurations, potentially affecting the device's intended function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05928

CVE-2023-38255

Affected Products

Modulys Gp

References · 11

• https://bdu.fstec.ru/vul/2023-05928 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38255 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38255 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2023090806 · Note
• https://t.me/cvenotify/86620 · Telegram Post
• https://twitter.com/CVEnew/status/1703865573803696407 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-250-03 · Note
• https://t.me/cvenotify/58435 · Telegram Post
• https://t.me/cvenotify/58065 · Telegram Post
• https://vuldb.com/ru/?id.239235 · Note
• https://t.me/cibsecurity/70675 · Telegram Post