CVE-2023-41089
Assigner: icscert
Published: 2023-10-19T18:13:25.005Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: DexGate
vendor: DEXMA
versions: status: affected
version: version 20130114
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Aarón Flecha Menéndez of S21sec reported these vulnerabilities to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legitimate" requests.</span>

</span>

</span>

</span>

</span>


value: 








The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legitimate" requests.










metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
source: discovery: UNKNOWN
title: Improper Authentication in DEXMA DEXGate
x_generator: engine: Vulnogram 0.1.0-dev