PT-2019-9666 · Sky · Sky Go Desktop

Sean Wright · Published 2019-01-19 · Updated 2019-10-03 · CVE-2018-18908

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sky Go Desktop application versions 1.0.19-1 through 1.0.23-1

Description The issue concerns the use of cleartext HTTP for several requests, making the submitted data susceptible to Man in The Middle (MiTM) attacks. An attacker could obtain sensitive information, such as the victim's Sky username, which is sent in some of these requests.

Recommendations For Sky Go Desktop application versions 1.0.19-1 through 1.0.23-1, consider disabling the use of cleartext HTTP requests until a patch is available. Restrict access to sensitive information, such as the Sky username, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2018-18908

Affected Products

Sky Go Desktop

References · 3

• 🔥 https://blog.sean-wright.com/sky · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18908 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18908 · Vendor Advisory