cvelistv5 - cve-2018-0691

cve-2018-0691

Vulnerability from cvelistv5

Published

2018-11-15 15:00

Modified

2024-08-05 03:35

Severity ?

Summary

Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

References

URL	Tags
vultures@jpcert.or.jp	http://jvn.jp/en/jp/JVN37288228/index.html	Third Party Advisory
vultures@jpcert.or.jp	https://www.au.com/information/notice_mobile/service/2018-002/	Patch, Vendor Advisory
vultures@jpcert.or.jp	https://www.nttdocomo.co.jp/info/notice/page/180927_00.html	Patch, Vendor Advisory
vultures@jpcert.or.jp	https://www.softbank.jp/mobile/info/personal/news/service/20180927a/	Patch, Vendor Advisory

Impacted products

Vendor

Product

Version

▼

Softbank, NTT docomo, KDDI

Version: Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:35:49.057Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.au.com/information/notice_mobile/service/2018-002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/"
          },
          {
            "name": "JVN#37288228",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23)",
          "vendor": "Softbank, NTT docomo, KDDI",
          "versions": [
            {
              "status": "affected",
              "version": "Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23"
            }
          ]
        }
      ],
      "datePublic": "2018-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to verify SSL certificates",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-15T14:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.au.com/information/notice_mobile/service/2018-002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/"
        },
        {
          "name": "JVN#37288228",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-0691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Softbank, NTT docomo, KDDI"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to verify SSL certificates"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.au.com/information/notice_mobile/service/2018-002/",
              "refsource": "MISC",
              "url": "https://www.au.com/information/notice_mobile/service/2018-002/"
            },
            {
              "name": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/",
              "refsource": "MISC",
              "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/"
            },
            {
              "name": "JVN#37288228",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
            },
            {
              "name": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html",
              "refsource": "MISC",
              "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-0691",
    "datePublished": "2018-11-15T15:00:00",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-08-05T03:35:49.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-0691\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2018-11-15T15:29:00.910\",\"lastModified\":\"2019-02-04T20:16:02.443\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples aplicaciones +Message (Softbank +Message App para Android en versiones anteriores a la 10.1.7, Softbank +Message App para iOS en versiones anteriores a la 1.1.23, NTT DOCOMO +Message App para Android en versiones anteriores a la 42.40.2800, NTT DOCOMO +Message App para iOS en versiones anteriores a la 1.1.23, KDDI +Message App para Android en versiones anteriores a la 1.0.6 y KDDI +Message App para iOS en versiones anteriores a la 1.1.23) no verifican los certificados X.509 de los servidores SSL, lo que permite que atacantes Man-in-the-Middle (MitM) suplanten servidores y obtengan informaci\u00f3n sensible mediante un certificado manipulado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kddi:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.6\",\"matchCriteriaId\":\"0244A620-EBAA-4F65-AB0C-62E6E170A79E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntttocomo:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"42.40.2800\",\"matchCriteriaId\":\"5C87A220-FE7E-4EE4-AF60-0B1E51F2C1C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:softbank:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.1.7\",\"matchCriteriaId\":\"BAEA3B86-3C5A-43E6-BF2E-0749FBA82134\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"340C4071-1447-477F-942A-8E09EA29F917\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kddi:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.23\",\"matchCriteriaId\":\"C5E96988-EF65-4FD7-AE75-1DC1665662D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntt_tocomo:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.23\",\"matchCriteriaId\":\"0F66E7A2-80AF-4B41-9A50-2515285485E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:softbank:\\\\+_message:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.23\",\"matchCriteriaId\":\"5B6F7401-252B-41F4-BAD8-3E744021F562\"}]}]}],\"references\":[{\"url\":\"http://jvn.jp/en/jp/JVN37288228/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.au.com/information/notice_mobile/service/2018-002/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.nttdocomo.co.jp/info/notice/page/180927_00.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.softbank.jp/mobile/info/personal/news/service/20180927a/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}

gsd-2018-0691

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2018-0691

Aliases

CVE-2018-0691

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-0691",
    "description": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
    "id": "GSD-2018-0691"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-0691"
      ],
      "details": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
      "id": "GSD-2018-0691",
      "modified": "2023-12-13T01:22:24.442022Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2018-0691",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Softbank, NTT docomo, KDDI"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Fails to verify SSL certificates"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.au.com/information/notice_mobile/service/2018-002/",
            "refsource": "MISC",
            "url": "https://www.au.com/information/notice_mobile/service/2018-002/"
          },
          {
            "name": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/",
            "refsource": "MISC",
            "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/"
          },
          {
            "name": "JVN#37288228",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
          },
          {
            "name": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html",
            "refsource": "MISC",
            "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:softbank:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "10.1.7",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:kddi:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.0.6",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:ntttocomo:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "42.40.2800",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:softbank:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.1.23",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:kddi:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.1.23",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:ntt_tocomo:\\+_message:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.1.23",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-0691"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-295"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a/"
            },
            {
              "name": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
            },
            {
              "name": "https://www.au.com/information/notice_mobile/service/2018-002/",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.au.com/information/notice_mobile/service/2018-002/"
            },
            {
              "name": "JVN#37288228",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2019-02-04T20:16Z",
      "publishedDate": "2018-11-15T15:29Z"
    }
  }
}

cve-2018-0691

Vulnerability from jvndb

Published

2018-09-27 16:52

Modified

2019-08-27 17:22

Severity ?

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

+Message App fails to verify SSL server certificates

Details

+Message App fails to verify SSL server certificates. ma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN37288228/
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0691
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-0691
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	KDDI	+Message (PlusMessage)
	NTT DOCOMO, INC.	+Message (PlusMessage)
	SoftBank	+Message (PlusMessage)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
  "dc:date": "2019-08-27T17:22+09:00",
  "dcterms:issued": "2018-09-27T16:52+09:00",
  "dcterms:modified": "2019-08-27T17:22+09:00",
  "description": "+Message App fails to verify SSL server certificates.\r\n\r\nma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:kddi:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nttdocomo:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:softbank:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000100",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN37288228/",
      "@id": "JVN#37288228",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0691",
      "@id": "CVE-2018-0691",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0691",
      "@id": "CVE-2018-0691",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "+Message App fails to verify SSL server certificates"
}

ghsa-wh57-pfpg-3fff

Vulnerability from github

Published

2022-05-14 01:37

Modified

2022-05-14 01:37

Severity ?

5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-0691"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-15T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NTT DOCOMO +Message App for Android prior to version 42.40.2800, NTT DOCOMO +Message App for iOS prior to version 1.1.23, KDDI +Message App for Android prior to version 1.0.6, and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-wh57-pfpg-3fff",
  "modified": "2022-05-14T01:37:00Z",
  "published": "2022-05-14T01:37:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0691"
    },
    {
      "type": "WEB",
      "url": "https://www.au.com/information/notice_mobile/service/2018-002"
    },
    {
      "type": "WEB",
      "url": "https://www.nttdocomo.co.jp/info/notice/page/180927_00.html"
    },
    {
      "type": "WEB",
      "url": "https://www.softbank.jp/mobile/info/personal/news/service/20180927a"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN37288228/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2018-0691

Vulnerability from cvelistv5

gsd-2018-0691

Vulnerability from gsd

cve-2018-0691

Vulnerability from jvndb

ghsa-wh57-pfpg-3fff

Vulnerability from github

Tags

Sightings

Nomenclature