{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5961","assignerOrgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","state":"PUBLISHED","assignerShortName":"Moxa","dateReserved":"2023-11-06T07:47:31.237Z","datePublished":"2023-12-23T09:01:02.875Z","dateUpdated":"2024-11-27T18:28:44.244Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"ioLogik E1200 Series","vendor":"Moxa","versions":[{"lessThanOrEqual":"3.3","status":"affected","version":"1.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Reza Rashidi from HADESS"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.</p>"}],"value":"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.\n\n"}],"impacts":[{"capecId":"CAPEC-62","descriptions":[{"lang":"en","value":"CAPEC-62: Cross Site Request Forgery"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352: Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"2e0a0ee2-d866-482a-9f5e-ac03d156dbaa","shortName":"Moxa","dateUpdated":"2023-12-23T09:01:02.875Z"},"references":[{"tags":["vendor-advisory"],"url":"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. </p><ul><li>ioLogik E1200 Series : Please contact Moxa Technical Support for the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.moxa.com/tw/support/technical-support\">security patch (v3.3.7).</a></li></ul>"}],"value":"Moxa has developed appropriate solutions to address the vulnerabilities. The solutions for affected products are shown below. \n\n  *  ioLogik E1200 Series : Please contact Moxa Technical Support for the  security patch (v3.3.7). https://www.moxa.com/tw/support/technical-support \n\n\n"}],"source":{"discovery":"EXTERNAL"},"title":"ioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability","x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T08:14:25.125Z"},"title":"CVE Program Container","references":[{"tags":["vendor-advisory","x_transferred"],"url":"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-235250-iologik-e1200-series-web-server-vulnerability"}]},{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-27T18:28:26.021021Z","id":"CVE-2023-5961","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-27T18:28:44.244Z"}}]}}