PT-2023-18852 · Selfwealth · Selfwealth Ios Mobile App

L00Neyhacker · Published 2023-02-01 · Updated 2023-02-08 · CVE-2023-23132

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Selfwealth iOS mobile App version 3.3.1

Description The issue concerns the disclosure of sensitive keys. Specifically, the application reveals hardcoded API keys.

Recommendations For Selfwealth iOS mobile App version 3.3.1, consider restricting access to the API endpoints that utilize the hardcoded keys until a patch is available. As a temporary workaround, avoid using the affected API endpoints that expose the sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-23132

Affected Products

Selfwealth Ios Mobile App

References · 4

• 🔥 https://github.com/l00neyhacker/CVE-2023-23132 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-23132 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23132 · Vendor Advisory
• https://t.me/cibsecurity/57290 · Telegram Post