CVE-2023-40732 LOW

CVE-2023-40732

Vendor Siemens

Product QMS Automotive

Weakness CWE-613 · Insufficient session expiration

Published September 12, 2023

Last update February 27, 2025

View on NVD All CVEs

CVSS base score

3.9/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C

What the vulnerability does

01Description

A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks.

Key dates

02Disclosure timeline

September 12, 2023 CVE published

February 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-40732 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/613.html

Related vulnerabilities

04Related CVE

CVE-2024-48926 Umbraco CMS logout page displayed before session expiration CVE-2021-1501 Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software SIP Denial of Service Vulnerability CVE-2026-41519 Weblate's API Token Not Invalidated on Password Change CVE-2023-0227 Insufficient Session Expiration in pyload/pyload CVE-2025-11429 Keycloak-server: too long and not settings compliant session