PT-2023-13437 · Aremis · A4N

Published 2023-02-27 · Updated 2025-03-11 · CVE-2022-34910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions A4N (Aremis 4 Nomad) version 1.5.0

Description An issue was discovered in the A4N application for Android, where it uses a local database to store data and accounts. However, the password is stored in cleartext, allowing an attacker to retrieve the passwords of other users who used the same device.

Recommendations For version 1.5.0, consider implementing proper password storage mechanisms, such as hashing and salting, to protect user passwords. As a temporary workaround, restrict access to the local database to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-34910

Affected Products

A4N

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-34910 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34910 · Vendor Advisory
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-34910 · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34910 · Note
• https://t.me/cvenotify/45057 · Telegram Post
• https://t.me/cvenotify/114256 · Telegram Post
• https://aremis.com/en_GB/welcome · Note
• https://t.me/cibsecurity/58941 · Telegram Post