PT-2012-5062 · Sand Studio · Airdroid

Publicado 2012-07-26 · Atualizado 2012-07-27 · CVE-2012-3888

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AirDroid version 1.0.4 beta

Description The issue allows remote attackers to bypass a multiple-login protection mechanism. This is achieved by modifying a pass value within JSON data in the login implementation.

Recommendations For AirDroid version 1.0.4 beta, consider restricting access to the login functionality until a fix is available. As a temporary workaround, avoid using the login feature with JSON data that contains a modified pass value. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-3888

Produtos afetados

Airdroid

Referências · 3

• 🔥 http://tele-consulting.com/advisories/TC-SA-2012-02.txt · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-07/0087.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3888 · Nota de Segurança