CVE-2023-5035

{"id": "CVE-2023-5035", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@moxa.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2023-11-02T17:15:11.677", "references": [{"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities", "tags": ["Vendor Advisory"], "source": "psirt@moxa.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "psirt@moxa.com", "description": [{"lang": "en", "value": "CWE-614"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.\n\n"}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en las versiones de firmware Series PT-G503 anteriores a la v5.2, donde el atributo Seguro para cookies sensibles en sesiones HTTPS no est\u00e1 configurado, lo que podr\u00eda causar que la cookie se transmita en texto plano a trav\u00e9s de una sesi\u00f3n HTTP. La vulnerabilidad puede generar riesgos de seguridad, exponiendo potencialmente los datos de la sesi\u00f3n del usuario a acceso y manipulaci\u00f3n no autorizados."}], "lastModified": "2023-11-09T19:54:28.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-g503_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEE72D70-1B7F-4F7C-ABA5-1542A0B4DC64", "versionEndExcluding": "5.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-g503:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "80A7E418-48BA-42E7-B0C6-AD9A3F1E18E8"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@moxa.com"}