Session Hijacking Vulnerability in QMS Automotive by Siemens
CVE-2023-40732

3.9LOW

Key Information:

Vendor
Siemens
Status
QMS Automotive
Vendor
CVE Published:
12 September 2023

Summary

A serious vulnerability exists in QMS Automotive software prior to version 12.39. The QMS.Mobile module fails to invalidate session tokens upon user logout. This oversight can potentially allow attackers to exploit the session and gain unauthorized access, leading to session hijacking. Organizations using this software should take immediate action to update to the latest version to mitigate the risk of exploitation.

Affected Version(s)

QMS Automotive All versions < V12.39

References

https://cert-portal.siemens.com/productcert/pdf/ssa-14726...

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.