github - ghsa-qrwh-wc9j-x9cj

ghsa-qrwh-wc9j-x9cj

Vulnerability from github

Published

2022-05-24 17:07

Modified

2022-05-24 17:07

Details

Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-5523"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-28T06:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Android App \u0027MyPallete\u0027 and some of the Android banking applications based on \u0027MyPallete\u0027 do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-qrwh-wc9j-x9cj",
  "modified": "2022-05-24T17:07:37Z",
  "published": "2022-05-24T17:07:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5523"
    },
    {
      "type": "WEB",
      "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
    },
    {
      "type": "WEB",
      "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
    },
    {
      "type": "WEB",
      "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2020-5523

Vulnerability from cvelistv5

Published

2020-01-28 05:25

Modified

2024-08-04 08:30

Severity ?

Summary

References

▼	URL	Tags
	http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html	x_refsource_MISC
	https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf	x_refsource_MISC
	https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf	x_refsource_MISC
	https://www.shikokubank.co.jp/info/apps20200128.html	x_refsource_MISC
	https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html	x_refsource_MISC
	https://www.naganobank.co.jp/soshiki/2/app-ssl.html	x_refsource_MISC
	https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf	x_refsource_MISC
	https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf	x_refsource_MISC
	https://www.hokugin.co.jp/info/archives/personal/2020/1913.html	x_refsource_MISC
	http://jvn.jp/en/jp/JVN28845872/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	NTT Data Corporation	'MyPallete' and some of the Android banking applications that use 'MyPallete'

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\u0027MyPallete\u0027 and some of the Android banking applications that use \u0027MyPallete\u0027",
          "vendor": "NTT Data Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Android App \u0027MyPallete\u0027 and some of the Android banking applications based on \u0027MyPallete\u0027 do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to verify SSL certificates",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-28T05:25:48",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5523",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "\u0027MyPallete\u0027 and some of the Android banking applications that use \u0027MyPallete\u0027",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NTT Data Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Android App \u0027MyPallete\u0027 and some of the Android banking applications based on \u0027MyPallete\u0027 do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to verify SSL certificates"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html",
              "refsource": "MISC",
              "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
            },
            {
              "name": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf",
              "refsource": "MISC",
              "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
            },
            {
              "name": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf",
              "refsource": "MISC",
              "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
            },
            {
              "name": "https://www.shikokubank.co.jp/info/apps20200128.html",
              "refsource": "MISC",
              "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
            },
            {
              "name": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html",
              "refsource": "MISC",
              "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
            },
            {
              "name": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html",
              "refsource": "MISC",
              "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
            },
            {
              "name": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf",
              "refsource": "MISC",
              "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
            },
            {
              "name": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf",
              "refsource": "MISC",
              "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
            },
            {
              "name": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html",
              "refsource": "MISC",
              "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
            },
            {
              "name": "http://jvn.jp/en/jp/JVN28845872/index.html",
              "refsource": "MISC",
              "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5523",
    "datePublished": "2020-01-28T05:25:48",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:30:24.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted