PT-2018-10420 · Makemytrip · Makemytrip

Divya Jain · Publicado 2018-05-20 · Atualizado 2019-10-03 · CVE-2018-11242

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MakeMyTrip version 7.2.4

Description An issue in the application allows for sensitive information disclosure due to the lack of encryption of locally stored databases. The databases contain cleartext data, which can be accessed through specific files, such as data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.

Recommendations For version 7.2.4, consider encrypting the locally stored databases to prevent sensitive information disclosure. As a temporary workaround, restrict access to the data/com.makemytrip/databases and data/com.makemytrip/Cache directories to minimize the risk of exploitation.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2018-11242

Produtos afetados

Makemytrip

Referências · 4

• 🔥 https://exploit-db.com/exploits/44690 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11242 · Aviso do Fabricante
• https://gist.github.com/NinjaXshell/ba0aeee4b77b4bdea76d0c0c095d53b1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11242 · Nota de Segurança