PT-2019-15131 · Dark Horse Comics · Dark Horse Comics

Jaeho Lee · Published 2019-10-15 · Updated 2019-10-17 · CVE-2019-17398

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dark Horse Comics application version 1.3.21

Description The application stores token information, equivalent to the username and password, in the log during authentication. This information may be accessible to attackers via logcat, potentially allowing them to obtain sensitive user credentials.

Recommendations For version 1.3.21, consider restricting access to logcat output to minimize the risk of exploitation. As a temporary workaround, avoid using the application for sensitive transactions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-17398

Affected Products

Dark Horse Comics

References · 3

• 🔥 https://pastebin.com/5ZDDCqgL · Exploit
• https://osv.dev/vulnerability/CVE-2019-17398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17398 · Security Note