PT-2018-13127 · Ola Cabs · Ola Money

Published 2018-08-21 · Updated 2024-08-05 · CVE-2018-15661

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ola Money (aka com.olacabs.olamoney) version 1.9.0

Description An issue was discovered in the Ola Money application for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. The vendor does not agree that this is a security issue requiring a fix.

Recommendations For Ola Money version 1.9.0, as a temporary workaround, consider restricting the use of the Forgot Password screen until the issue is resolved. Additionally, review and restrict applications with accessibility permissions and the ability to read SMS messages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-15661

Affected Products

Ola Money

References · 4

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15661 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15661 · Vendor Advisory
• https://t.me/cvenotify/89160 · Telegram Post