CVE-2023-28901CWE-200

Trip Data Disclosure from Backend

Medium · published January 18, 2024

CVSS v3.1

5.3

EPSS

Percentile

42.4

In the wild

Unconfirmed

What it is

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00507 · 42.4th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2024-01-18T16:27Z

EPSS history

Timeline

18 JAN 16:27Z
Trip Data Disclosure from Backend
cvelistv5