Medium severity · published Nov 2, 2023
CVE-2023-4217
Session cookies attribute not set properly
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
PT-G503 Series · Moxa
1.0 through 5.2 · source: vendor
EF
Eds-g503 Firmware · Moxa
before 5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4217
Mitigation
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230203-pt-g503-series-multiple-vulnerabilities
More from PT-G503 Series
9.4
CVE-2024-9137
Moxa Service Missing Authentication for Critical Function
9.2
CVE-2024-12297
Frontend Authorization Logic Disclosure Vulnerability
7.5
CVE-2024-7695
Out-of-bounds Write Vulnerability
7.5
CVE-2024-9404
Denial-of-Service Vulnerability
5.3
CVE-2023-5035
Cookie Without Secure Flag