PT-2023-13437 · Aremis · A4N

Publicado 2023-02-27 · Atualizado 2025-03-11 · CVE-2022-34910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions A4N (Aremis 4 Nomad) version 1.5.0

Description An issue was discovered in the A4N application for Android, where it uses a local database to store data and accounts. However, the password is stored in cleartext, allowing an attacker to retrieve the passwords of other users who used the same device.

Recommendations For version 1.5.0, consider implementing proper password storage mechanisms, such as hashing and salting, to protect user passwords. As a temporary workaround, restrict access to the local database to minimize the risk of exploitation.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2022-34910

Produtos afetados

A4N

Referências · 8

• https://excellium-services.com/cert-xlm-advisory/CVE-2022-34910 · Nota
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34910 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-34910 · Nota de Segurança
• https://t.me/cvenotify/45057 · Publicação no Telegram
• https://t.me/cvenotify/114256 · Publicação no Telegram
• https://aremis.com/en_GB/welcome · Nota
• https://osv.dev/vulnerability/CVE-2022-34910 · Aviso do Fabricante
• https://t.me/cibsecurity/58941 · Publicação no Telegram