CVE-2023-28003

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Schneider Electric	EcoStruxure Power Monitoring Expert	>= All, <= PME 2022

References

Timeline

Published: Apr 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-280049.8A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of s CVE-2023-280056.8A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical a CVE-2023-280067.8The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.CVE-2023-280088.1HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot CVE-2023-280098.1HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp CVE-2023-28015.3Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data source CVE-2023-280105.3In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.CVE-2023-280128.8HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI ser CVE-2023-280136.1HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote,CVE-2023-280145.4HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the applicat CVE-2023-280155.3The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a differe CVE-2023-280166.1Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input