PT-2019-9498 · Envoy · Envoy Passport For Android+1

Published 2019-03-19 · Updated 2020-08-24 · CVE-2018-17500

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Envoy Passport for Android (affected versions not specified) Envoy Passport for iPhone (affected versions not specified)

Description The issue is caused by the storage of hardcoded OAuth credentials in plaintext, allowing a local attacker to obtain sensitive information. An attacker could exploit this to gain access to sensitive information.

Recommendations For Envoy Passport for Android, consider removing or securely storing hardcoded OAuth credentials to prevent exploitation. For Envoy Passport for iPhone, consider removing or securely storing hardcoded OAuth credentials to prevent exploitation. As a temporary workaround, consider restricting access to sensitive information stored by the application until a secure method of storing OAuth credentials is implemented.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-17500

Affected Products

Envoy Passport For Android

Envoy Passport For Iphone

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-17500 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17500 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149660 · Note