PT-2017-13485 · Ohmibod · Ohmibod Remote

Publicado 2017-12-01 · Atualizado 2019-10-03 · CVE-2017-14487

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OhMiBod Remote app for Android and iOS (affected versions not specified)

Description The issue allows remote attackers to impersonate users by intercepting network traffic for search responses from the OhMiBod API server. Attackers can then modify the username, user id, and token fields in the data stored in the OMB.xml file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2017-14487

Produtos afetados

Ohmibod Remote

Referências · 3

• https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14487 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14487 · Aviso do Fabricante