PT-2017-8542 · Money Forward+1 · Money Forward For Tokai Tokyo Securities+10

Akinori Konishi + 2 · Published 2017-05-12 · Updated 2021-05-12 · CVE-2016-4839

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Money Forward versions prior to 7.18.0 Money Forward for The Gunma Bank versions prior to 1.2.0 Money Forward for SHIGA BANK versions prior to 1.2.0 Money Forward for SHIZUOKA BANK versions prior to 1.4.0 Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0 Money Forward for Tokai Tokyo Securities versions prior to 1.4.0 Money Forward for THE TOHO BANK versions prior to 1.3.0 Money Forward for YMFG versions prior to 1.5.0 Money Forward for AppPass versions prior to 7.18.3 Money Forward for au SMARTPASS versions prior to 7.18.0 Money Forward for Chou Houdai versions prior to 7.18.3

Description The Android apps do not properly implement the WebView class, allowing an attacker to disclose information stored on the device via a specially crafted application.

Recommendations For Money Forward versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for The Gunma Bank versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIGA BANK versions prior to 1.2.0, update to version 1.2.0 or later. For Money Forward for SHIZUOKA BANK versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for SBI Sumishin Net Bank versions prior to 1.6.0, update to version 1.6.0 or later. For Money Forward for Tokai Tokyo Securities versions prior to 1.4.0, update to version 1.4.0 or later. For Money Forward for THE TOHO BANK versions prior to 1.3.0, update to version 1.3.0 or later. For Money Forward for YMFG versions prior to 1.5.0, update to version 1.5.0 or later. For Money Forward for AppPass versions prior to 7.18.3, update to version 7.18.3 or later. For Money Forward for au SMARTPASS versions prior to 7.18.0, update to version 7.18.0 or later. For Money Forward for Chou Houdai versions prior to 7.18.3, update to version 7.18.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-4839

Affected Products

Android

Money Forward

Money Forward For Apppass

Money Forward For Chou Houdai

Money Forward For Sbi Sumishin Net Bank

Money Forward For Shiga Bank

Money Forward For The Toho Bank

Money Forward For The Gunma Bank

Money Forward For Tokai Tokyo Securities

Money Forward For Ymfg

Money Forward For Au Smartpass

References · 7

• https://osv.dev/vulnerability/CVE-2016-4839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4839 · Security Note
• https://t.me/cvenotify/14305 · Telegram Post
• http://securityfocus.com/bid/93035 · Note
• http://corp.moneyforward.com/info/20160920-mf-android · Note
• http://sourcenext.com/support/i/160725_1 · Note
• https://jvn.jp/en/jp/JVN61297210/index.html · Note