Vulnerabilities > CVE-2023-28824 - Server-Side Request Forgery (SSRF) vulnerability in Contec Conprosys HMI System

047910
CVSS 4.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
HIGH
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
contec
CWE-918
NVD
Published: 2023-06-01
Updated: 2024-11-21

Summary

Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may bypass the database restriction set on the query setting page, and connect to a user unintended database.

Vulnerable Configurations

Part Description Count
Application
Contec
8

Common Weakness Enumeration (CWE)

References