Lucene search

CertccCVE-2016-6548

HistoryJul 13, 2018 - 8:29 p.m.

CVE-2016-6548

2018-07-1320:29:00

CWE-200

certcc

web.nvd.nist.gov

zizai tech nut

mobile app

http

https

security

session token

nvd

cve-2016-6548

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.011

Percentile

84.8%

JSON

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user’s authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user’s account.

Affected configurations

Nvd

Node

nutspacenut_mobileMatch-

VendorProductVersionCPE
nutspacenut_mobile-cpe:2.3:a:nutspace:nut_mobile:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nutspace	nut_mobile	-	cpe:2.3:a:nutspace:nut_mobile:-:::::::*

CNA Affected

[
  {
    "product": "Tech Nut Mobile Application",
    "vendor": "Zizai Technology",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  }
]

References

blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/

www.kb.cert.org/vuls/id/402847

www.securityfocus.com/bid/93877

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.011

Percentile

84.8%

JSON

Related for CVE-2016-6548