PT-2019-9498 · Envoy · Envoy Passport For Android+1

Publicado 2019-03-19 · Atualizado 2020-08-24 · CVE-2018-17500

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Envoy Passport for Android (affected versions not specified) Envoy Passport for iPhone (affected versions not specified)

Description The issue is caused by the storage of hardcoded OAuth credentials in plaintext, allowing a local attacker to obtain sensitive information. An attacker could exploit this to gain access to sensitive information.

Recommendations For Envoy Passport for Android, consider removing or securely storing hardcoded OAuth credentials to prevent exploitation. For Envoy Passport for iPhone, consider removing or securely storing hardcoded OAuth credentials to prevent exploitation. As a temporary workaround, consider restricting access to sensitive information stored by the application until a secure method of storing OAuth credentials is implemented.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-17500

Produtos afetados

Envoy Passport For Android

Envoy Passport For Iphone

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/149660 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17500 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17500 · Aviso do Fabricante