PT-2021-17156 · Unknown · Timelybills

Published 2021-04-06 · Updated 2021-04-14 · CVE-2021-26833

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: TimelyBills versions 1.7.0 and earlier for iOS TimelyBills versions 1.21.115 and earlier for Android

Description: The issue allows an attacker with local file access to obtain JWT tokens for a user's account due to insufficient cache clearing mechanisms. This can lead to the exposure of sensitive user data, as the JWT tokens are signed and encoded but not encrypted, allowing a threat actor to decode them and access the information.

Recommendations: For TimelyBills versions 1.7.0 and earlier for iOS, update to a version later than 1.7.0 to resolve the issue. For TimelyBills versions 1.21.115 and earlier for Android, update to a version later than 1.21.115 to resolve the issue. As a temporary workaround, consider restricting access to the local file system to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2021-26833

Affected Products

Timelybills

References · 3

• 🔥 https://beefaaubee.medium.com/cve-2021-26833-cleartext-storage-in-a-file-or-on-disk-in-timelybills-1-7-0-5760dc461bd0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-26833 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26833 · Vendor Advisory