CVE-2024-39886

{"id": "CVE-2024-39886", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2024-07-10T07:15:03.247", "references": [{"url": "https://jvn.jp/en/jp/JVN28515217/", "source": "vultures@jpcert.or.jp"}, {"url": "https://tone.ne.jp/vulnerability/14492007.html", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-419"}]}], "descriptions": [{"lang": "en", "value": "TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App."}, {"lang": "es", "value": "La versi\u00f3n 3.4.2 y anteriores de la aplicaci\u00f3n TONE store contiene un problema con el canal principal desprotegido. Dado que la aplicaci\u00f3n TONE store se comunica con el sitio web de TONE store en texto plano, un ataque man-in-the-middle puede permitir a un atacante obtener y/o alterar las comunicaciones de la aplicaci\u00f3n afectada."}], "lastModified": "2024-07-11T15:06:15.210", "sourceIdentifier": "vultures@jpcert.or.jp"}