CVE-2023-41084 Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
Attackers can steal session cookies to bypass authentication and perform unauthorized actions on the Socomec UPS web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41084?
CVE-2023-41084 is a critical missing authorization vulnerability in Socomec MODULYS GP (MOD3GP-SY-120K), published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
Weakness: CWE-565
Which versions are affected by CVE-2023-41084?
It affects 1 product.
Products include Socomec Modulys Gp Firmware.
How do I fix CVE-2023-41084?
No fix has been published for CVE-2023-41084 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-41084 being exploited?
There is no known exploitation of CVE-2023-41084 in the wild and no public exploit code.
Other vulnerabilities in Socomec MODULYS GP (MOD3GP-SY-120K)
- CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery
- CVE-2023-40221 Socomec MOD3GP-SY-120K Code Injection
- CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password
- CVE-2023-41965 Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information
- CVE-2023-38255 Socomec MOD3GP-SY-120K Cross-site Scripting
Sources
Also known as GHSA-c8f6-fgc7-qf74.