Lucene search

MitreCVE-2018-15660

HistoryAug 21, 2018 - 5:29 p.m.

CVE-2018-15660

2018-08-2117:29:00

mitre

web.nvd.nist.gov

cve-2018-15660

ola money

android

accessibility permissions

data exposure

security issue

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.004

Percentile

75.1%

JSON

An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Money data such as a credit card number, expiration date, bank account number, and transaction history. NOTE: the vendor does not agree that this is a security issue requiring a fix

Affected configurations

Nvd

Node

olacabsolamoneyMatch1.9.0android

VendorProductVersionCPE
olacabsolamoney1.9.0cpe:2.3:a:olacabs:olamoney:1.9.0:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
olacabs	olamoney	1.9.0	cpe:2.3:a:olacabs:olamoney:1.9.0:::::android::

References

github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.004

Percentile

75.1%

JSON

Related for CVE-2018-15660