CVE-2023-4228

ioLogik 4000 Series: Session Cookies Attribute Not Set Properly

State: Published
Severity: 3.1 Low
Published: Aug 24, 2023
Updated: Oct 1, 2024
Reserved: Aug 8, 2023

Description

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	Moxa

Weaknesses

CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

Affected Products

Product	Versions
ioLogik 4000 SeriesMoxa	1.0 through 1.6Affected

References

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerabilityvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.