CVE-2023-39446 HIGH

CVE-2023-39446: Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Vendor Socomec
Product MODULYS GP (MOD3GP-SY-120K)
Weakness CWE-352 · CSRF
Published September 18, 2023
Last update September 24, 2024
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

What the vulnerability does

01Description

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.

Key dates

02Disclosure timeline

September 18, 2023 CVE published
September 24, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-30816 WordPress publish post email notification plugin <= 1.0.2.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability CVE-2022-3154 Multiple Plugins from Viszt Peter - Multiple CSRF CVE-2024-53726 WordPress RealtyCandy IDX Broker Extended plugin <= 1.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability CVE-2025-58250 WordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-1463 Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish