PT-2019-15131 · Dark Horse Comics · Dark Horse Comics

Jaeho Lee · Publicado 2019-10-15 · Atualizado 2019-10-17 · CVE-2019-17398

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dark Horse Comics application version 1.3.21

Description The application stores token information, equivalent to the username and password, in the log during authentication. This information may be accessible to attackers via logcat, potentially allowing them to obtain sensitive user credentials.

Recommendations For version 1.3.21, consider restricting access to logcat output to minimize the risk of exploitation. As a temporary workaround, avoid using the application for sensitive transactions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-17398

Produtos afetados

Dark Horse Comics

Referências · 3

• 🔥 https://pastebin.com/5ZDDCqgL · Exploit
• https://osv.dev/vulnerability/CVE-2019-17398 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17398 · Nota de Segurança