Lucene search

JpcertCVE-2016-7812

HistoryAug 02, 2017 - 4:29 p.m.

CVE-2016-7812

2017-08-0216:29:00

CWE-310

jpcert

web.nvd.nist.gov

bank of tokyo

mitsubishi ufj

android

cve-2016-7812

tls

ssl

man-in-the-middle

encryption

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

20.9%

JSON

The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication.

Affected configurations

Nvd

Vulners

Node

mufgmitsubishi_ufjRange≤5.2.2android

mufgmitsubishi_ufjMatch5.3.1android

VendorProductVersionCPE
mufgmitsubishi_ufj*cpe:2.3:a:mufg:mitsubishi_ufj:*:*:*:*:android:*:*:*
mufgmitsubishi_ufj5.3.1cpe:2.3:a:mufg:mitsubishi_ufj:5.3.1:*:*:*:android:*:*:*

Vendor	Product	Version	CPE
mufg	mitsubishi_ufj	*	cpe:2.3:a:mufg:mitsubishi_ufj:::::android:::*
mufg	mitsubishi_ufj	5.3.1	cpe:2.3:a:mufg:mitsubishi_ufj:5.3.1::::android:::

CNA Affected

[
  {
    "product": "The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android",
    "vendor": "The Bank of Tokyo-Mitsubishi UFJ, Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "ver5.3.1"
      }
    ]
  },
  {
    "product": "The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android",
    "vendor": "The Bank of Tokyo-Mitsubishi UFJ, Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "ver5.2.2 and earlier"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94829

jvn.jp/en/vu/JVNVU92900492/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

20.9%

JSON

Related for CVE-2016-7812