Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | 2.2 | 5.2 |
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-295,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| hokkaidobank | dogin | * |
| nttdata | mypallete | - |
| ashikagabank | ashigin | * |
| naganobank | nagagin | * |
| hokugin | hokuriku_bank_portal | * |
| tohoku-bank | tougin | * |
| 77bank | 77_bank | * |
| shikokubank | shikoku_bank | * |
| sihd-bk | ikeda_senshu_bank | * |