PT-2020-18632 · Studyplus · Studyplus App For Android+1

Ryo Sato · Published 2020-11-06 · Updated 2020-11-17 · CVE-2020-5667

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Studyplus App for Android versions 6.3.7 and earlier Studyplus App for iOS versions 8.29.0 and earlier

Description The issue concerns the use of a hard-coded API key for an external service in the affected apps. This could allow the API key to be obtained by analyzing data within the app.

Recommendations For Studyplus App for Android versions 6.3.7 and earlier, consider removing or securely storing the hard-coded API key until a patch is available. For Studyplus App for iOS versions 8.29.0 and earlier, consider removing or securely storing the hard-coded API key until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-5667

Affected Products

Studyplus App For Android

Studyplus App For Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-5667 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5667 · Vendor Advisory
• https://t.me/cibsecurity/15964 · Telegram Post
• https://jvn.jp/en/jp/JVN00414047/index.html · Note