CVE-2023-5035

A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:moxa:eds-g503:-:*:*:*:*:*:*:*

cpe:2.3:o:moxa:eds-g503_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-02 17:15

Updated : 2023-11-09 19:54

NVD link : CVE-2023-5035

Mitre link : CVE-2023-5035

CVE.ORG link : CVE-2023-5035

JSON object : View

Products Affected

moxa

eds-g503
eds-g503_firmware

CWE

CWE-319

Cleartext Transmission of Sensitive Information

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

{"id": "CVE-2023-5035", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@moxa.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2023-11-02T17:15:11.677", "references": [{"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities", "tags": ["Vendor Advisory"], "source": "psirt@moxa.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Secondary", "source": "psirt@moxa.com", "description": [{"lang": "en", "value": "CWE-614"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.\n\n"}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en las versiones de firmware Series PT-G503 anteriores a la v5.2, donde el atributo Seguro para cookies sensibles en sesiones HTTPS no est\u00e1 configurado, lo que podr\u00eda causar que la cookie se transmita en texto plano a trav\u00e9s de una sesi\u00f3n HTTP. La vulnerabilidad puede generar riesgos de seguridad, exponiendo potencialmente los datos de la sesi\u00f3n del usuario a acceso y manipulaci\u00f3n no autorizados."}], "lastModified": "2023-11-09T19:54:28.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:moxa:eds-g503:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "80A7E418-48BA-42E7-B0C6-AD9A3F1E18E8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:moxa:eds-g503_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEE72D70-1B7F-4F7C-ABA5-1542A0B4DC64", "versionEndExcluding": "5.2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@moxa.com"}