CVE-2024-7698 Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products
A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: PHOENIX CONTACT
product: FL MGUARD 2102
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 2105
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4102 PCI
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4102 PCIE
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4302
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4305
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CENTERPORT VPN-1000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CORE TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CORE TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD DELTA TX/TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD DELTA TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD GT/GT
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD GT/GT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCI4000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCI4000 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCIE4000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCIE4000 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2000 TX/TX-B
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2000 TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2005 TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX-M
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX-P
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4004 TX/DTX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4004 TX/DTX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD SMART2
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD SMART2 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 3G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G ATT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G VZW VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 3G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G ATT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G VZW VPN
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrea Palanca
lang: en
value: Nozomi Networks Security Research Team
Published: 2024-09-10T08:42:42.629Z