Lucene search

ASRGCVE-2023-28901

HistoryJan 18, 2024 - 5:15 p.m.

CVE-2023-28901

2024-01-1817:15:14

CWE-200

ASRG

web.nvd.nist.gov

skoda

automotive

cloud

access control

vulnerability

security

nvd

cve-2023-28901

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Affected configurations

Nvd

Node

skoda-autoskoda_connectMatch-

VendorProductVersionCPE
skoda-autoskoda_connect-cpe:2.3:a:skoda-auto:skoda_connect:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
skoda-auto	skoda_connect	-	cpe:2.3:a:skoda-auto:skoda_connect:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Skoda Connect",
    "vendor": "Skoda Auto",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

asrg.io/security-advisories/cve-2023-28901/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Related for CVE-2023-28901