CVE-2023-41965 Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information
Attackers can obtain sensitive information from the Socomec MODULYS GP web interface due to insecure storage and authentication flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41965?
CVE-2023-41965 is a high-severity vulnerability in Socomec MODULYS GP (MOD3GP-SY-120K), published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
Which versions are affected by CVE-2023-41965?
It affects 1 product.
Products include Socomec Modulys Gp Firmware.
How do I fix CVE-2023-41965?
No fix has been published for CVE-2023-41965 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-41965 being exploited?
There is no known exploitation of CVE-2023-41965 in the wild and no public exploit code.
Other vulnerabilities in Socomec MODULYS GP (MOD3GP-SY-120K)
- CVE-2023-41084 Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
- CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery
- CVE-2023-40221 Socomec MOD3GP-SY-120K Code Injection
- CVE-2023-39452 Socomec MOD3GP-SY-120K Plaintext Storage of a Password
- CVE-2023-38255 Socomec MOD3GP-SY-120K Cross-site Scripting
Sources
Also known as GHSA-w545-288r-rf3p.