Lucene search

[email protected]CVE-2020-5523

HistoryJan 28, 2020 - 6:15 a.m.

CVE-2020-5523

2020-01-2806:15:12

CWE-295

[email protected]

web.nvd.nist.gov

android

mypallete

banking applications

security

certificate validation

x.509

man-in-the-middle

spoofing

sensitive information

nvd

cve-2020-5523

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

Android App ‘MyPallete’ and some of the Android banking applications based on ‘MyPallete’ do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected configurations

Vulners

NVD

Node

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match1.0.4

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match3.0.4

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match2.0.1

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match1.0.1

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match2.0.1

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match3.0.1

ntt_data_corporation\'mypallete\'_and_some_of_the_android_banking_applications_that_use_\'mypallete\'Match2.0.1

CPENameOperatorVersion
77bank:77_bank77bank 77 bankle2.0.1
ashikagabank:ashiginashikagabank ashiginle1.0.4
hokkaidobank:doginhokkaidobank doginle3.0.1
hokugin:hokuriku_bank_portalhokugin hokuriku bank portalle2.0.1
naganobank:nagaginnaganobank nagaginle1.0.1
nttdata:mypalletenttdata mypalleteeq-
shikokubank:shikoku_bankshikokubank shikoku bankle2.0.1
sihd-bk:ikeda_senshu_banksihd-bk ikeda senshu bankle3.0.4
tohoku-bank:tougintohoku-bank touginle1.0.1

CPE	Name	Operator	Version
77bank:77_bank	77bank 77 bank	le	2.0.1
ashikagabank:ashigin	ashikagabank ashigin	le	1.0.4
hokkaidobank:dogin	hokkaidobank dogin	le	3.0.1
hokugin:hokuriku_bank_portal	hokugin hokuriku bank portal	le	2.0.1
naganobank:nagagin	naganobank nagagin	le	1.0.1
nttdata:mypallete	nttdata mypallete	eq	-
shikokubank:shikoku_bank	shikokubank shikoku bank	le	2.0.1
sihd-bk:ikeda_senshu_bank	sihd-bk ikeda senshu bank	le	3.0.4
tohoku-bank:tougin	tohoku-bank tougin	le	1.0.1

CNA Affected

[
  {
    "product": "'MyPallete' and some of the Android banking applications that use 'MyPallete'",
    "vendor": "NTT Data Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN28845872/index.html

www.dokodemobank.ne.jp/info_20200128_bankingapp.html

www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf

www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf

www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf

www.hokugin.co.jp/info/archives/personal/2020/1913.html

www.naganobank.co.jp/soshiki/2/app-ssl.html

www.shikokubank.co.jp/info/apps20200128.html

www.sihd-bk.jp/common_v2/pdf/20200127.pdf

www.tohoku-bank.co.jp/news/topics/200128_applissl.html

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

Related for CVE-2020-5523

jvn1 prion1 nvd1 cvelist1