Lucene search

MitreCVE-2018-11242

HistoryMay 20, 2018 - 2:29 p.m.

CVE-2018-11242

2018-05-2014:29:00

CWE-312

mitre

web.nvd.nist.gov

cve-2018-11242

makemytrip

android

sensitive information disclosure

database encryption

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.

Affected configurations

Nvd

Node

makemytripmakemytripMatch7.2.4android

VendorProductVersionCPE
makemytripmakemytrip7.2.4cpe:2.3:a:makemytrip:makemytrip:7.2.4:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
makemytrip	makemytrip	7.2.4	cpe:2.3:a:makemytrip:makemytrip:7.2.4:::::android::

References

gist.github.com/NinjaXshell/ba0aeee4b77b4bdea76d0c0c095d53b1

www.exploit-db.com/exploits/44690/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

Related for CVE-2018-11242