PT-2018-13126 · Ola Cabs · Ola Money

Published 2018-08-21 · Updated 2024-08-05 · CVE-2018-15660

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ola Money (aka com.olacabs.olamoney) version 1.9.0

Description An issue was discovered in the Ola Money application for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Money data such as a credit card number, expiration date, bank account number, and transaction history. The vendor does not agree that this is a security issue requiring a fix.

Recommendations For Ola Money version 1.9.0, consider restricting the use of accessibility permissions to minimize the risk of exploitation. As a temporary workaround, review and limit the permissions granted to other applications to prevent potential data access. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2018-15660

Affected Products

Ola Money

References · 5

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15660 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15660 · Vendor Advisory
• https://t.me/cvenotify/82909 · Telegram Post
• https://t.me/cvenotify/89159 · Telegram Post