CVE-2020-23533

CVE-2020-23533 affects Union Pay web versions up to 1.2.0 and is linked to a CWE-347 vulnerability: improper verification of a cryptographic signature. An attacker can craft an authentication code (MAC) generated from a NULL/empty key to make free purchases on merchant websites and mobile apps. C...

CVE-2020-36284

The CVE-2020-36284 issue affects UnionPay on Android versions prior to 3.4.93.4.9. Root cause: improper verification of cryptographic signatures (CWE-347) due to a MAC generated based on a secret key that is NULL. Impact: attackers can shop for free on merchants’ websites and mobile apps by craft...

CVE-2020-36285

CVE-2020-36285 concerns Union Pay for iOS up to version 3.3.12. The vulnerability is described as CWE-347: Improper Verification of Cryptographic Signature, where an authentication code (MAC) is generated based on a secret key that is NULL/empty. This permits attackers to shop for free on merchan...