cve-2023-40732
Vulnerability from cvelistv5
Published
2023-09-12 09:32
Modified
2024-08-02 18:38
Severity
Summary
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks.
References
Source | URL | Tags |
---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf | Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
Siemens | QMS Automotive |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T18:38:51.290Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "QMS Automotive", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V12.39" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks." } ], "metrics": [ { "cvssV3_1": { "baseScore": 3.9, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-09-12T09:32:32.841Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf" } ] } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2023-40732", "datePublished": "2023-09-12T09:32:32.841Z", "dateReserved": "2023-08-21T10:57:08.486Z", "dateUpdated": "2024-08-02T18:38:51.290Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-40732\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2023-09-12T10:15:29.593\",\"lastModified\":\"2023-09-14T16:49:50.890\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in QMS Automotive (All versions \u003c V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en QMS Automotive (todas las versiones \u0026lt; V12.39). El m\u00f3dulo QMS.Mobile la aplicaci\u00f3n afectada no invalida el token de sesi\u00f3n al cerrar sesi\u00f3n. Esto podr\u00eda permitir a un atacante realizar ataques de secuestro de sesi\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.9,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":1.3,\"impactScore\":2.5},{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.9,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":1.3,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:qms_automotive:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.39\",\"matchCriteriaId\":\"17162BBB-9C4B-4347-B2F6-F8E40D67C954\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading...