CVE-2020-23533

Опубликовано: 06 апр. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.

Ссылки

http://mobitec.ie.cuhk.edu.hk/cve_2020/
Permissions Required
https://cwe.mitre.org/data/definitions/347.html
Technical Description
https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0
Third Party Advisory
https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
Third Party Advisory
http://mobitec.ie.cuhk.edu.hk/cve_2020/
Permissions Required
https://cwe.mitre.org/data/definitions/347.html
Technical Description
https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0
Third Party Advisory
https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:unionpayintl:union_pay:*:*:*:*:*:*:*:*

Версия до 1.2.0 (включая)

EPSS

Процентиль: 36%

0.00154

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-347

Связанные уязвимости

GHSA-chw7-q7hh-9vc2