PT-2018-8540 · National Payments Corporation Of India · Bhim

Publicado 2018-08-24 · Atualizado 2018-11-01 · CVE-2017-9821

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions National Payments Corporation of India BHIM application version 1.3

Description The issue concerns the National Payments Corporation of India BHIM application, which relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS validation. This makes it easier for attackers to bypass authentication.

Recommendations For National Payments Corporation of India BHIM application version 1.3, consider restricting the use of hardcoded strings for SMS validation until a patch is available. As a temporary workaround, avoid using the hardcoded strings AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM for authentication purposes.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-9821

Produtos afetados

Bhim

Referências · 4

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-9821 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148923 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9821 · Nota de Segurança