CVE-2024-36279

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36279
Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
https://freefrom.space/
https://jvn.jp/en/jp/JVN55045256/
https://play.google.com/store/apps/details?id=com.freefrom
Configurations

No configuration.

History

03 Jul 2024, 02:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-649

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) La dependencia de la ofuscación o el cifrado de entradas relevantes para la seguridad sin problemas de verificación de integridad existe en las versiones de la aplicación "FreeFrom - the nostr client" anteriores a la 1.3.5 para Android e iOS. Si se explota esta vulnerabilidad, el contenido de los mensajes directos (DM) entre usuarios puede ser manipulado mediante un ataque de intermediario.

17 Jun 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-17 08:15

Updated : 2024-07-03 02:03

NVD link : CVE-2024-36279

Mitre link : CVE-2024-36279

CVE.ORG link : CVE-2024-36279

JSON object : View

Products Affected

No product.

CWE
CWE-649

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking