Lucene search

ASRGCVELIST:CVE-2023-28901

HistoryJan 18, 2024 - 4:27 p.m.

CVE-2023-28901 Trip Data Disclosure from Backend

2024-01-1816:27:43

CWE-200

ASRG

www.cve.org

cve-2023-28901

trip data disclosure

backend

broken access control

remote attackers

vehicle vin

skoda connect

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Skoda Connect",
    "vendor": "Skoda Auto",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

asrg.io/security-advisories/cve-2023-28901/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Related for CVELIST:CVE-2023-28901