Lucene search

ASRGCVELIST:CVE-2023-28900

HistoryJan 18, 2024 - 4:23 p.m.

CVE-2023-28900 Nickname Disclosure on the Backend Automotive Server

2024-01-1816:23:07

CWE-200

ASRG

www.cve.org

cve-2023-28900

nickname disclosure

backend automotive server

broken access control

skoda connect service

vin number

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Škoda Connect",
    "vendor": "Škoda Auto",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

asrg.io/security-advisories/cve-2023-28900

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVELIST:CVE-2023-28900