PT-2023-18852 · Selfwealth · Selfwealth Ios Mobile App

L00Neyhacker · Publicado 2023-02-01 · Atualizado 2023-02-08 · CVE-2023-23132

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Selfwealth iOS mobile App version 3.3.1

Description The issue concerns the disclosure of sensitive keys. Specifically, the application reveals hardcoded API keys.

Recommendations For Selfwealth iOS mobile App version 3.3.1, consider restricting access to the API endpoints that utilize the hardcoded keys until a patch is available. As a temporary workaround, avoid using the affected API endpoints that expose the sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-23132

Produtos afetados

Selfwealth Ios Mobile App

Referências · 4

• 🔥 https://github.com/l00neyhacker/CVE-2023-23132 · Exploit
• https://t.me/cibsecurity/57290 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23132 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23132 · Aviso do Fabricante