Lucene search

MitreCVE-2019-17355

HistoryOct 15, 2019 - 9:15 p.m.

CVE-2019-17355

2019-10-1521:15:09

CWE-532

mitre

web.nvd.nist.gov

orbitz

android

credentials

log

security vulnerability

authentication

cve-2019-17355

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.007

Percentile

79.7%

JSON

In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.

Affected configurations

Nvd

Node

orbitzorbitzMatch19.31.1android

VendorProductVersionCPE
orbitzorbitz19.31.1cpe:2.3:a:orbitz:orbitz:19.31.1:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
orbitz	orbitz	19.31.1	cpe:2.3:a:orbitz:orbitz:19.31.1:::::android::

References

pastebin.com/GgpFz3ZW

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.007

Percentile

79.7%

JSON

Related for CVE-2019-17355