Lucene search

ASRGCVE-2023-28900

HistoryJan 18, 2024 - 5:15 p.m.

CVE-2023-28900

2024-01-1817:15:13

CWE-200

ASRG

web.nvd.nist.gov

skoda

automotive

cloud

broken access control

vulnerability

user data exposure

skoda connect

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Affected configurations

Nvd

Node

skoda-autoskoda_connectMatch-

VendorProductVersionCPE
skoda-autoskoda_connect-cpe:2.3:a:skoda-auto:skoda_connect:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
skoda-auto	skoda_connect	-	cpe:2.3:a:skoda-auto:skoda_connect:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Škoda Connect",
    "vendor": "Škoda Auto",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

asrg.io/security-advisories/cve-2023-28900

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-28900