CVE-2023-39467
Trianglemicroworks Scada Data Gateway 5.1.3.20324
Raw vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-39467 is a medium-severity Storage of File with Sensitive Data Under Web Root (CWE-219) vulnerability in Trianglemicroworks Scada Data Gateway. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique DCSync (T1003.006); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43190
Vulnerability Data
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within…
more
the configuration of certificate web directory. The issue results from the exposure of sensitive information in the application webroot. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20798.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.4
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces logical access authorizations on resources, stopping unauthorized parties from reaching sensitive files stored under the web root.
AC-6 limits granted privileges to the minimum needed, reducing the chance that web-accessible paths expose sensitive data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege access permissions directly prevents unauthorized retrieval of sensitive files stored under the web root.
Protecting confidentiality of data-at-rest mitigates exposure of files that should never have been placed under the web root.
Hardened configuration baselines and change control prevent placement of sensitive files in publicly served directories.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Classification identifies sensitive data so it can be placed outside the web root.
Access-control policy defines who may reach files under the web root.
Granting only the minimum rights prevents unauthorized retrieval of sensitive files.
Secure SDLC practices include placing sensitive data outside the document root.