Insufficient Session Expiration in PME from Schneider Electric
CVE-2023-28003

6.7MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure Power Monitoring Expert
Vendor
CVE Published:
18 April 2023

What is CVE-2023-28003?

A vulnerability has been identified in PME, where an insufficient session expiration issue allows an attacker to exploit a hijacked session, retaining unauthorized access even after the legitimate user has logged out. This vulnerability raises concerns regarding user privacy and data security, emphasizing the need for robust session management practices to protect sensitive information from unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

EcoStruxure Power Monitoring Expert All

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.