CVE-2018-17402

{"id": "CVE-2018-17402", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2018-09-23T22:29:00.730", "references": [{"url": "https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20-%20Credit%20and%20Debit%20Card%20Leak.pdf", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots"}, {"lang": "es", "value": "** EN DISPUTA ** La aplicaci\u00f3n de cartera PhonePe (tambi\u00e9n conocida como com.PhonePe.app) desde la versi\u00f3n 3.0.6 a la 3.3.26 para Android podr\u00eda permitir que los atacantes descubran el n\u00famero de tarjeta de cr\u00e9dito/d\u00e9bito, fecha de expiraci\u00f3n y n\u00famero CVV. NOTA: el fabricante dice que, para explotar esto, el usuario debe instalar expl\u00edcitamente una aplicaci\u00f3n maliciosa y otorgar el permiso de accesibilidad a la aplicaci\u00f3n maliciosa, y que la plataforma Android proporciona avisos suficientes a los usuarios antes de habilitar la accesibilidad para cualquier aplicaci\u00f3n. Adem\u00e1s, cree que es similar a instalar techados maliciosos o a que una aplicaci\u00f3n maliciosa tome instant\u00e1neas."}], "lastModified": "2024-11-21T03:54:20.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phonepe:phonepe:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "79E18E1A-AC58-4297-B18D-44A75279EF84", "versionEndIncluding": "3.3.26", "versionStartIncluding": "3.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}