PT-2018-8539 · National Payments Corporation Of India · Bhim

Publicado 2018-08-24 · Atualizado 2018-11-01 · CVE-2017-9820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions National Payments Corporation of India BHIM application version 1.3

Description The issue concerns the custom keypad in the BHIM application, where the input element is accessible to the Accessibility service. This accessibility makes it easier for attackers to bypass authentication.

Recommendations For version 1.3, consider restricting access to the Accessibility service for the custom keypad input element until a patch is available. As a temporary workaround, users may want to avoid using the custom keypad for sensitive transactions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-9820

Produtos afetados

Bhim

Referências · 4

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148925 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9820 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9820 · Aviso do Fabricante