PT-2010-5362 · Wells Fargo · Wells Fargo Mobile

Publicado 2010-11-08 · Atualizado 2010-11-09 · CVE-2010-4214

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wells Fargo Mobile application version 1.1

Description The issue concerns the storage of sensitive information in cleartext, which could allow physically proximate attackers to obtain this information by reading application data. This includes usernames, passwords, and account balances.

Recommendations For version 1.1, consider removing or securely storing sensitive information, such as usernames, passwords, and account balances, to prevent unauthorized access. As a temporary workaround, restrict physical access to devices with the Wells Fargo Mobile application installed until a secure storage mechanism is implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-4214

Produtos afetados

Wells Fargo Mobile

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-4214 · Nota de Segurança
• http://online.wsj.com/article/SB10001424052748703805704575594581203248658.html · Nota
• http://viaforensics.com/appwatchdog/wells-fargo-android.html · Nota
• http://news.cnet.com/8301-27080_3-20021874-245.html · Nota