A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03 | Third Party Advisory US Government Resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03 - Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Nov 2023, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device. |
22 Sep 2023, 14:32
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Socomec modulys Gp Firmware
Socomec modulys Gp Socomec |
|
| CPE | cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:*:*:*:*:*:*:* cpe:2.3:h:socomec:modulys_gp:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03 - Third Party Advisory, US Government Resource |
19 Sep 2023, 03:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-18 21:15
Updated : 2024-11-21 08:13
NVD link : CVE-2023-38255
Mitre link : CVE-2023-38255
CVE.ORG link : CVE-2023-38255
JSON object : View
Products Affected
socomec
- modulys_gp
- modulys_gp_firmware
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')