2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SCADA Data Gateway","vendor":"Triangle MicroWorks","versions":[{"status":"affected","version":"5.01.03"}]}],"source":"trellixpsirt@trellix.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:trianglemicroworks:scada_data_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"A763593D-AA02-4DF7-9D24-A88EB254594D","versionEndIncluding":"5.01.03","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a \"password change event\". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events."},{"lang":"es","value":"En la versión menor o igual a v5.01.03 de SCADA Data Gateway de Triangle MicroWorks, un atacante no autenticado puede enviar eventos de difusión a cualquier usuario a través del WebMonitor. Un usuario no autenticado puede usar esta vulnerabilidad para cerrar la sesión forzosamente de cualquier usuario actualmente conectado enviando un 'evento de cambio de contraseña'. Además, un atacante podría usar esta vulnerabilidad para enviar correo no deseado al usuario conectado con eventos falsos."}],"id":"CVE-2023-2187","lastModified":"2026-10-23T23:10:00.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"trellixpsirt@trellix.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-2187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-01-06T21:08:33.609789Z","version":"2.0.3"}}]},"published":"2023-06-07T07:15:08.740","references":[{"source":"trellixpsirt@trellix.com","tags":["Third Party Advisory"],"url":"https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.trellix.com/en-us/about/newsroom/stories/research/industrial-and-manufacturing-cves.html"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"trellixpsirt@trellix.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
|