CVE-2023-41084
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.07%
- CWE
- CWE-565
- Published
- 2023-09-18
- Last modified
- 2026-03-13
Affected products
- Socomec MODULYS GP (MOD3GP-SY-120K)
Weakness type
Related vulnerabilities
- CVE-2026-0257 — PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
- CVE-2023-45128 — CSRF Token Reuse Vulnerability in fiber
- CVE-2025-2395 — e-Excellence U-Office Force - Improper Authentication
- CVE-2022-50926 — WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
- CVE-2014-125112 — Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution
- CVE-2023-32725 — Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2024-9970 — NewType FlowMaster BPM Plus - Privilege Escalation
- CVE-2024-22186 — Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking