CVE-2023-5961 (GCVE-0-2023-5961)

Vulnerability from cvelistv5 – Published: 2023-12-23 09:01 – Updated: 2024-11-27 18:28
VLAI?
Title
ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability
Summary
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
Moxa ioLogik E1200 Series Affected: 1.0 , ≤ 3.3 (custom)
Create a notification for this product.
Credits
Reza Rashidi from HADESS
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:14:25.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-27T18:28:26.021021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T18:28:44.244Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ioLogik E1200 Series",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.3",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Reza Rashidi from HADESS"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\u003c/p\u003e"
            }
          ],
          "value": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62: Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-23T09:01:02.875Z",
        "orgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
        "shortName": "Moxa"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMoxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. \u003c/p\u003e\u003cul\u003e\u003cli\u003eioLogik E1200 Series : Please contact Moxa Technical Support for the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.moxa.com/tw/support/technical-support\"\u003esecurity patch (v3.3.7).\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. \n\n  *  ioLogik E1200 Series : Please contact Moxa Technical Support for the  security patch (v3.3.7). https://www.moxa.com/tw/support/technical-support \n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2e0a0ee2-d866-482a-9f5e-ac03d156dbaa",
    "assignerShortName": "Moxa",
    "cveId": "CVE-2023-5961",
    "datePublished": "2023-12-23T09:01:02.875Z",
    "dateReserved": "2023-11-06T07:47:31.237Z",
    "dateUpdated": "2024-11-27T18:28:44.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1210_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"CF14969B-6E9F-4553-96EB-7BE6C5834260\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1210:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"67DDCD42-10D5-46B2-AB91-66EF30D5D645\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1211_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"D03FA4E2-4A30-4ED9-BA4D-5546FC0BA939\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1211:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"308E46FB-488A-4907-9A69-AACDE23A3394\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1212_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"BA133D93-4A1D-419A-92C5-C0C0A35187B5\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1212:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"616E5D0B-0D3A-4808-8C15-2FDC35E8605C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1213_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"6E39755B-9625-4D95-B425-BD28B60180CA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1213:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9AAE4F4E-779C-401F-A75E-AC66757DD313\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1214_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"F59B517D-63C4-4FE5-A89F-B2A235E8239A\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1214:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A0837606-60F7-4563-8F80-AE7C1CC3F469\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1240_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"90601A69-F749-4E68-A034-74B9F046436F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1240:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77A9D90D-0419-410C-AF65-0FFE0FF2882F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1241_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"38280BA6-C262-45AC-AD33-813523F64DAB\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1241:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3239D045-8A7C-4407-B77C-E82C178D8B90\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1242_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"EB237801-4287-4A30-8CE8-DB90FAB5C118\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1242:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D40DF4C-0EA9-44B0-8D8C-D1FC2AB5A357\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1260_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"ACDAE3E7-675E-44BF-BD57-BF5C31B969A5\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1260:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B0B4FA04-BF84-4B8A-A295-0312A3790F2E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:moxa:iologik_e1262_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3\", \"matchCriteriaId\": \"485CCB1F-A642-48B2-A8AD-4A7EBB5791BD\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:moxa:iologik_e1262:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3366C39B-50FD-497B-A6A1-875CEB8913C5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Se identific\\u00f3 una vulnerabilidad de Cross-Site Request Forgery (CSRF) en las versiones de firmware de la serie ioLogik E1200 v3.3 y anteriores. Un atacante puede aprovechar esta vulnerabilidad para enga\\u00f1ar a un cliente para que realice una solicitud no intencionada al servidor web, que ser\\u00e1 tratada como una solicitud aut\\u00e9ntica. Esta vulnerabilidad puede llevar a un atacante a realizar operaciones en nombre del usuario v\\u00edctima.\"}]",
      "id": "CVE-2023-5961",
      "lastModified": "2024-11-21T08:42:52.213",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@moxa.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2023-12-23T09:15:07.730",
      "references": "[{\"url\": \"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\", \"source\": \"psirt@moxa.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@moxa.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"psirt@moxa.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-5961\",\"sourceIdentifier\":\"psirt@moxa.com\",\"published\":\"2023-12-23T09:15:07.730\",\"lastModified\":\"2024-11-21T08:42:52.213\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad de Cross-Site Request Forgery (CSRF) en las versiones de firmware de la serie ioLogik E1200 v3.3 y anteriores. Un atacante puede aprovechar esta vulnerabilidad para enga\u00f1ar a un cliente para que realice una solicitud no intencionada al servidor web, que ser\u00e1 tratada como una solicitud aut\u00e9ntica. Esta vulnerabilidad puede llevar a un atacante a realizar operaciones en nombre del usuario v\u00edctima.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@moxa.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@moxa.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1210_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"CF14969B-6E9F-4553-96EB-7BE6C5834260\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1210:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67DDCD42-10D5-46B2-AB91-66EF30D5D645\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1211_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"D03FA4E2-4A30-4ED9-BA4D-5546FC0BA939\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1211:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"308E46FB-488A-4907-9A69-AACDE23A3394\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1212_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"BA133D93-4A1D-419A-92C5-C0C0A35187B5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1212:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"616E5D0B-0D3A-4808-8C15-2FDC35E8605C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1213_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"6E39755B-9625-4D95-B425-BD28B60180CA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1213:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AAE4F4E-779C-401F-A75E-AC66757DD313\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1214_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"F59B517D-63C4-4FE5-A89F-B2A235E8239A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1214:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0837606-60F7-4563-8F80-AE7C1CC3F469\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1240_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"90601A69-F749-4E68-A034-74B9F046436F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1240:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77A9D90D-0419-410C-AF65-0FFE0FF2882F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1241_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"38280BA6-C262-45AC-AD33-813523F64DAB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1241:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3239D045-8A7C-4407-B77C-E82C178D8B90\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1242_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"EB237801-4287-4A30-8CE8-DB90FAB5C118\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1242:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D40DF4C-0EA9-44B0-8D8C-D1FC2AB5A357\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1260_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"ACDAE3E7-675E-44BF-BD57-BF5C31B969A5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1260:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0B4FA04-BF84-4B8A-A295-0312A3790F2E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:moxa:iologik_e1262_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3\",\"matchCriteriaId\":\"485CCB1F-A642-48B2-A8AD-4A7EBB5791BD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:moxa:iologik_e1262:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3366C39B-50FD-497B-A6A1-875CEB8913C5\"}]}]}],\"references\":[{\"url\":\"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\",\"source\":\"psirt@moxa.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T08:14:25.125Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-5961\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-27T18:28:26.021021Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-27T18:28:41.032Z\"}}], \"cna\": {\"title\": \"ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Reza Rashidi from HADESS\"}], \"impacts\": [{\"capecId\": \"CAPEC-62\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-62: Cross Site Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Moxa\", \"product\": \"ioLogik E1200 Series\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.3\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. \\n\\n  *  ioLogik E1200 Series : Please contact Moxa Technical Support for the  security patch (v3.3.7). https://www.moxa.com/tw/support/technical-support \\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMoxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. \u003c/p\u003e\u003cul\u003e\u003cli\u003eioLogik E1200 Series : Please contact Moxa Technical Support for the \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.moxa.com/tw/support/technical-support\\\"\u003esecurity patch (v3.3.7).\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352: Cross-Site Request Forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa\", \"shortName\": \"Moxa\", \"dateUpdated\": \"2023-12-23T09:01:02.875Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-5961\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-27T18:28:44.244Z\", \"dateReserved\": \"2023-11-06T07:47:31.237Z\", \"assignerOrgId\": \"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa\", \"datePublished\": \"2023-12-23T09:01:02.875Z\", \"assignerShortName\": \"Moxa\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.