CVE-2023-39446

Published: Sep 18, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.

Affected (1)

Products: Socomec: Modulys Gp Firmware

1 product

Modulys Gp Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Socomec Modulys Gp Firmware	Version 01.12.10

Running on/with	Platform Versions
Socomec Modulys Gp	All versions

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.