PT-2018-14015 · Phonepe · Phonepe

Publicado 2018-09-23 · Atualizado 2024-08-05 · CVE-2018-17402

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PhonePe wallet (aka com.PhonePe.app) versions 3.0.6 through 3.3.26

Description The issue might allow attackers to discover sensitive information, including Credit/Debit card numbers, expiration dates, and CVV numbers. To exploit this, a user must explicitly install a malicious app and provide accessibility permission to the malicious app. The Android platform provides warnings to users before enabling accessibility for any application. This is similar to the risks associated with installing malicious keyboards or apps that take screenshots.

Recommendations For versions 3.0.6 through 3.3.26, consider uninstalling the app or restricting its accessibility permissions until a fix is available. As a temporary workaround, avoid installing unknown or untrusted apps, and be cautious when providing accessibility permissions to any application.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-17402

Produtos afetados

Phonepe

Referências · 4

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-17402 · Aviso do Fabricante
• https://t.me/cvenotify/89180 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-17402 · Nota de Segurança