PT-2020-18501 · Awms · Awms Mobile App

Published 2020-01-31 · Updated 2020-02-10 · CVE-2020-5526

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AWMS Mobile App for Android versions 2.0.0 through 2.0.5 AWMS Mobile App for iOS versions 2.0.0 through 2.0.8

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from servers.

Recommendations For Android versions 2.0.0 through 2.0.5, update the app to a version that verifies X.509 certificates from servers. For iOS versions 2.0.0 through 2.0.8, update the app to a version that verifies X.509 certificates from servers.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-5526

Affected Products

Awms Mobile App

References · 5

• http://onlinesupport.fujixerox.com/processDriverForm.do?ctry_code=SG&lang_code=en&d_lang=en&corp_pid=AWMS2&rts=null&model=ApeosWare+Management+Suite+2&type_id=7&oslist=Windows+10+64bit&lang_list=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5526 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5526 · Vendor Advisory
• http://jvn.jp/en/jp/JVN00014057/index.html · Note
• https://t.me/cvenotify/695 · Telegram Post