Socomec MOD3GP-SY-120K Cross-site Scripting
CVE-2023-38255

6.1MEDIUM

Key Information:

Vendor

Socomec

Status
Modulys Gp (mod3gp-sy-120k)
Vendor
CVE Published:
18 September 2023

What is CVE-2023-38255?

A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.

Affected Version(s)

MODULYS GP (MOD3GP-SY-120K) v01.12.10

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-2...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aarón Flecha Menéndez reported these vulnerabilities to CISA.
.