CVE-2023-2639

MEDIUM Year: 2023
CVSS v3 Score
4.7
Medium
Weakness Type
CWE-346
View all →

Vulnerability Description

The underlying feedback mechanism of Rockwell Automation's FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This may allow a threat actor to craft a malicious website that, when visited, will send a malicious script that can connect to the local WebSocket endpoint and wait for events as if it was a valid client device. If successfully exploited, this would allow a threat actor to receive information including whether FactoryTalk Policy Manager is installed and potentially the entire security policy.

Related Vulnerabilities

CVE-2020-26251

MEDIUM
CVSS:4.7(Medium)

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing polic...

CWE-3462020

CVE-2021-26737

MEDIUM
CVSS:4.7(Medium)

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting ...

CWE-3462021

CVE-2020-26234

MEDIUM
CVSS:4.8(Medium)

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using...

CWE-3462020

CVE-2022-1747

MEDIUM
CVSS:4.6(Medium)

The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker could leverage this vulnera...

CWE-3462022

CVE-2023-2445

MEDIUM
CVSS:4.9(Medium)

Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user v...

CWE-3462023

CVE-2019-4640

MEDIUM
CVSS:4.4(Medium)

IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which could result in an attacker executing malic...

CWE-3462019