Information disclosure

2017-04-2816:59:00

PRIOn knowledge base

www.prio-n.com

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.7%

JSON

The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CPENameOperatorVersion
lala_callle2.4.7

CPE	Name	Operator	Version
	lala_call	le	2.4.7

References

jvn.jp/en/jp/JVN01014759/index.html

www.securityfocus.com/bid/96004