PT-2020-18498 · Google · Android
Dai Nakamura
·
Published
2020-01-28
·
Updated
2020-01-31
·
CVE-2020-5523
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
MyPallete (affected versions not specified)
Some Android banking applications based on MyPallete (affected versions not specified)
Description
The issue concerns the failure to verify X.509 certificates from servers and improper validation of certificates with host-mismatch. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Recommendations
For MyPallete, ensure proper validation of X.509 certificates from servers and implement host-mismatch checks to prevent man-in-the-middle attacks.
For Android banking applications based on MyPallete, consider disabling or restricting the use of the vulnerable certificate validation mechanism until a proper fix is implemented.
As a temporary workaround, restrict access to sensitive information and consider using additional security measures to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Android