PT-2021-19329 · Ionic · Ionic Identity Vault

Published 2021-09-07 · Updated 2021-09-24 · CVE-2021-3145

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ionic Identity Vault versions prior to 5

Description A local root attacker on an Android device can bypass biometric authentication. This issue affects Ionic Identity Vault and allows unauthorized access.

Recommendations For versions prior to 5, update to version 5 or later to resolve the issue. As a temporary workaround, consider disabling biometric authentication until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-3145

Affected Products

Ionic Identity Vault

References · 7

• 🔥 http://packetstormsecurity.com/files/164085/Ionic-Identity-Vault-4.7-Android-Biometric-Authentication-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-3145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3145 · Security Note
• https://ionic.io/products/identity-vault · Vendor Advisory
• https://t.me/defcon_news/84499 · Telegram Post
• https://t.me/cvenotify/21377 · Telegram Post
• https://t.me/cibsecurity/28693 · Telegram Post