Siemens QMS Automotive
En bref
- Source
- NVD
- EPSS
- EPSS 0.20 % · centile 10 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- siemens
- Statut NVD
- Modified
Rechercher sur…
Description
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage. This could allow an attacker to alter content, leading to arbitrary code execution or denial-of-service condition.
Faiblesses (CWE)
- CWE-922 — Insecure Storage of Sensitive Information
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C | siemens |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-45282
- GCVE · GCVE-0-2023-40728
Avis du CERT-FR
- CERTFR-2023-AVI-0733 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:siemens:qms_automotive:*:*:*:*:*:*:*:*< 12.39
Produits affectés
| Produit | Versions |
|---|---|
| Siemens · QMS Automotive | affected All versions < V12.39 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |