CVE-2020-5523
Published Jan 28, 2020
Last updated 5 years ago
Overview
- Description
- Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Source
- vultures@jpcert.or.jp
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.4
- Impact score
- 5.2
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5.8
- Impact score
- 4.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-295
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:77bank:77_bank:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "7F484419-4038-47D4-85CF-1756BFB67E2A",
"versionEndIncluding": "2.0.1"
},
{
"criteria": "cpe:2.3:a:ashikagabank:ashigin:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "04BF27EE-2955-4517-8A7B-D8F39631B7B6",
"versionEndIncluding": "1.0.4"
},
{
"criteria": "cpe:2.3:a:hokkaidobank:dogin:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "488D7CBE-9389-4DA7-99AE-3AF33FCE5FA8",
"versionEndIncluding": "3.0.1"
},
{
"criteria": "cpe:2.3:a:hokugin:hokuriku_bank_portal:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "8CD46460-45D4-46FC-84F9-7D22EB5B2D27",
"versionEndIncluding": "2.0.1"
},
{
"criteria": "cpe:2.3:a:naganobank:nagagin:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "5B219F59-31DC-48E1-8590-79868C05BB98",
"versionEndIncluding": "1.0.1"
},
{
"criteria": "cpe:2.3:a:nttdata:mypallete:-:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "145255E1-B0C0-4B0B-8C5D-63A21982042C"
},
{
"criteria": "cpe:2.3:a:shikokubank:shikoku_bank:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "F02DADD1-75A5-4155-A88C-D3383C6BB3CE",
"versionEndIncluding": "2.0.1"
},
{
"criteria": "cpe:2.3:a:sihd-bk:ikeda_senshu_bank:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "396C963D-0260-4BCD-AA7C-0FB6055A298F",
"versionEndIncluding": "3.0.4"
},
{
"criteria": "cpe:2.3:a:tohoku-bank:tougin:*:*:*:*:*:android:*:*",
"vulnerable": true,
"matchCriteriaId": "9FA99794-E4DA-410D-B278-8D5955E2C6BF",
"versionEndIncluding": "1.0.1"
}
],
"operator": "OR"
}
]
}
]