PT-2024-28710 · Unknown · Tone Store App

Kodai Karakawa · Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-39886

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TONE store App versions 3.4.2 and earlier

Description The issue is related to an unprotected primary channel in the TONE store App, which communicates with the TONE store website in cleartext. This could allow a man-in-the-middle attack, enabling an attacker to obtain and/or alter communications of the affected App.

Recommendations For versions 3.4.2 and earlier, consider disabling communication with the TONE store website until a secure connection method is implemented to prevent man-in-the-middle attacks. Restrict access to sensitive data within the App to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-419

Related Identifiers

CVE-2024-39886

Affected Products

Tone Store App

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-39886 · Security Note
• https://t.me/cvenotify/85670 · Telegram Post
• https://tone.ne.jp/vulnerability/14492007.html · Note
• https://twitter.com/VulmonFeeds/status/1810989332473299133 · Twitter Post
• https://jvn.jp/en/jp/JVN28515217 · Note
• https://twitter.com/CVEnew/status/1810944903645684049 · Twitter Post
• https://t.me/cvedetector/518 · Telegram Post