PT-2019-13726 · Uidai · Maadhaar

Publicado 2019-08-13 · Atualizado 2019-08-19 · CVE-2019-14516

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions mAadhaar application version 1.2.7

Description The issue concerns a lack of SSL Certificate Validation in the mAadhaar application, making it susceptible to man-in-the-middle attacks. Specifically, this affects requests for FAQs or Help, potentially compromising the security of user interactions.

Recommendations For mAadhaar application version 1.2.7, consider disabling the use of FAQs or Help features until a patch is available that implements proper SSL Certificate Validation to prevent man-in-the-middle attacks.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-14516

Produtos afetados

Maadhaar

Referências · 6

• 🔥 https://github.com/fs0c131y/ConPresentations/blob/master/AppSecVillageDefcon27.mAadhaar.pdf · Exploit
• https://github.com/fs0c131y/ConPresentations · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14516 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14516 · Aviso do Fabricante
• https://t.me/yah_channel/206 · Publicação no Telegram
• https://play.google.com/store/apps/details?id=in.gov.uidai.mAadhaarPlus&hl=en_US · Aviso do Fabricante