CVE-2014-7242

Опубликовано: 18 окт. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and earlier for Android allow man-in-the-middle attackers to spoof servers and obtain sensitive information by leveraging failure to verify SSL/TLS server certificates.

Ссылки

http://jvn.jp/en/jp/JVN27388160/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000125.html
Third Party Advisory
VDB Entry
http://jvn.jp/en/jp/JVN27388160/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000125.html
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ms-ins:sumaho:*:*:*:*:*:android:*:*

Версия до 3.0.0 (включая)

cpe:2.3:a:ms-ins:sumaho_driving_capability_diagnosis:*:*:*:*:*:android:*:*

Версия до 1.2.2 (включая)

EPSS

Процентиль: 49%

0.00256

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-qf3v-hhp7-rfh5