CVE-2023-28901

Published Jan 18, 2024

Last updated 10 months ago

CVSS medium 5.3

Overview

Description: The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
Source: cve@asrg.io
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
cve@asrg.io: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:skoda-auto:skoda_connect:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "52F83D74-D8F0-4D6C-B382-6E1ECE9373AF"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References