PT-2017-13485 · Ohmibod · Ohmibod Remote

Published 2017-12-01 · Updated 2019-10-03 · CVE-2017-14487

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OhMiBod Remote app for Android and iOS (affected versions not specified)

Description The issue allows remote attackers to impersonate users by intercepting network traffic for search responses from the OhMiBod API server. Attackers can then modify the username, user id, and token fields in the data stored in the OMB.xml file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2017-14487

Affected Products

Ohmibod Remote

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-14487 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14487 · Vendor Advisory
• https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat · Note