CVE-2020-5532

ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://jvn.jp/en/jp/JVN35496038/index.html	Third Party Advisory
https://apps.apple.com/us/app/ilbo/id1116864683	Product Release Notes
https://play.google.com/store/apps/details?id=jp.extrun.ilbo&hl=en	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:extrun:ilbo::::::android::*
	cpe:2.3:a:extrun:ilbo::::::iphone_os::*

History

No history.

Information

Published : 2020-02-14 14:15

Updated : 2024-02-28 17:28

NVD link : CVE-2020-5532

Mitre link : CVE-2020-5532

CVE.ORG link : CVE-2020-5532

JSON object : View

Products Affected

extrun

ilbo

CWE

CWE-287

Improper Authentication

{"id": "CVE-2020-5532", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-02-14T14:15:10.717", "references": [{"url": "http://jvn.jp/en/jp/JVN35496038/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://apps.apple.com/us/app/ilbo/id1116864683", "tags": ["Product", "Release Notes"], "source": "vultures@jpcert.or.jp"}, {"url": "https://play.google.com/store/apps/details?id=jp.extrun.ilbo&hl=en", "tags": ["Product"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors."}, {"lang": "es", "value": "La Aplicaci\u00f3n ilbo (la Aplicaci\u00f3n ilbo para Android versiones anteriores a 1.1.8 y la Aplicaci\u00f3n ilbo para iOS versiones anteriores a 1.2.01), permite a un atacante sobre el mismo segmento de red omitir la autenticaci\u00f3n y visualizar las im\u00e1genes que fueron grabadas por el otro dispositivo de un usuario ilbo, por medio de vectores no especificados."}], "lastModified": "2020-02-25T17:52:00.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:extrun:ilbo:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "6BD46E5A-646B-4DB1-B979-BCA25B7E1209", "versionEndExcluding": "1.1.8"}, {"criteria": "cpe:2.3:a:extrun:ilbo:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "403E8DFD-CCF8-429C-8F6E-D4644DD99B91", "versionEndExcluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}