Socomec MOD3GP-SY-120K Cross-site Scripting
CVE-2023-38582

5.4MEDIUM

Key Information:

Vendor

Socomec

Status
MODULYS GP (MOD3GP-SY-120K)
Vendor
CVE Published:
18 September 2023

What is CVE-2023-38582?

Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.

Affected Version(s)

MODULYS GP (MOD3GP-SY-120K) v01.12.10

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-2...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aarón Flecha Menéndez reported these vulnerabilities to CISA.
.