CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.

CVSS v3 2.9 LOW
CVSS v2.0 2.1 LOW

2.9^/10

CVSS v3 : LOW

Vector : AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/149659	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/149659	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:envoy:passport:2.2.5:::::iphone_os::
	cpe:2.3:a:envoy:passport:2.4.0:::::android::

History

21 Nov 2024, 03:54

Type	Values Removed	Values Added
CVSS	v2 : ~~2.1~~ v3 : ~~5.5~~	v2 : 2.1 v3 : 2.9
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/149659 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/149659 - Third Party Advisory, VDB Entry

Information

Published : 2019-03-21 16:00

Updated : 2024-11-21 03:54

NVD link : CVE-2018-17499

Mitre link : CVE-2018-17499

CVE.ORG link : CVE-2018-17499

JSON object : View

Products Affected

envoy

passport

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2018-17499", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-03-21T16:00:26.093", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149659", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149659", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information."}, {"lang": "es", "value": "Envoy Passport para Android y iPhone podr\u00eda permitir que un atacante local obtenga informaci\u00f3n sensible, provocado por el almacenamiento de datos no cifrados en los registros. Un atacante podr\u00eda explotar esta vulnerabilidad para obtener dos claves API, un token y otro tipo de informaci\u00f3n sensible."}], "lastModified": "2024-11-21T03:54:33.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoy:passport:2.2.5:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "7BEAE86E-C111-4EB7-B8E8-77AA6C30E321"}, {"criteria": "cpe:2.3:a:envoy:passport:2.4.0:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "0106581C-AA22-4EFD-8AA5-DC1FA54849A9"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}