PT-2018-16878 · Oral B · Oral-B App

Publicado 2018-01-08 · Atualizado 2018-01-31 · CVE-2018-5298

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oral-B App version 5.0.0

Description The issue concerns the use of AES encryption with static parameters to secure locally stored shared preferences in the Oral-B App. This could allow an attacker to more easily gain access to locally stored user data by leveraging access to the preferences XML file.

Recommendations For version 5.0.0, consider implementing dynamic encryption parameters to secure the locally stored shared preferences, and restrict access to the preferences XML file to minimize the risk of exploitation.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2018-5298

Produtos afetados

Oral-B App

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-5298 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5298 · Nota de Segurança
• https://1337sec.blogspot.de/2018/01/auditing-oral-b-app-v500.html · Nota