JVN#28845872: Android App "MyPallete" vulnerable to improper server certificate verification

Android App “MyPallete” developed by NTT Data Corporation is used by several financial institutions as Android applications for their customers.
“MyPallete” is vulnerable to improper server certificate verification (CWE-295) and to improper host-matching validation (CWE-297).

Impact

A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.

Solution

Update the Application
Apply the latest update according to the information provided by the developer and/or respective financial institutions.

Products Affected

• Android App “MyPallete”
• Android applications based on “MyPallete”
  As for the details of the affected Android applications using “MyPallete”, refer to the information under the section [Vendor Status].