The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
References
| Link | Resource |
|---|---|
| https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ | Exploit Third Party Advisory |
| https://www.kb.cert.org/vuls/id/402847 | Third Party Advisory US Government Resource |
| https://www.securityfocus.com/bid/93877 | Third Party Advisory VDB Entry |
| https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ | Exploit Third Party Advisory |
| https://www.kb.cert.org/vuls/id/402847 | Third Party Advisory US Government Resource |
| https://www.securityfocus.com/bid/93877 | Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 02:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - Exploit, Third Party Advisory | |
| References | () https://www.kb.cert.org/vuls/id/402847 - Third Party Advisory, US Government Resource | |
| References | () https://www.securityfocus.com/bid/93877 - Third Party Advisory, VDB Entry |
Information
Published : 2018-07-13 20:29
Updated : 2024-11-21 02:56
NVD link : CVE-2016-6548
Mitre link : CVE-2016-6548
CVE.ORG link : CVE-2016-6548
JSON object : View
Products Affected
nutspace
- nut_mobile
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor