PT-2019-17787 · Google+1 · Android+1
Deral Heiland
+1
·
Publicado
2019-05-22
·
Atualizado
2020-10-16
·
CVE-2019-5626
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BlueCats Reveal versions prior to 3.0.19
Description
The issue allows an attacker to compromise the affected BlueCats network implementation by accessing a clear text file that stores the
username and password. This file remains on the device until the user logs out or the session times out after 30 days of inactivity. To exploit this, an attacker would first need to gain physical control of the Android device or compromise it with a malicious app.Recommendations
For versions prior to 3.0.19, update to version 3.0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to prevent unauthorized physical or remote access to the Android device.
Exploit
Correção
Insufficiently Protected Credentials
Insecure Storage of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Android
Bluecats Reveal