PT-2012-5062 · Sand Studio · Airdroid

Published 2012-07-26 · Updated 2012-07-27 · CVE-2012-3888

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AirDroid version 1.0.4 beta

Description The issue allows remote attackers to bypass a multiple-login protection mechanism. This is achieved by modifying a pass value within JSON data in the login implementation.

Recommendations For AirDroid version 1.0.4 beta, consider restricting access to the login functionality until a fix is available. As a temporary workaround, avoid using the login feature with JSON data that contains a modified pass value. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3888

Affected Products

Airdroid

References · 3

• 🔥 http://tele-consulting.com/advisories/TC-SA-2012-02.txt · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-07/0087.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3888 · Security Note