jvndb - jvndb-2016-000124

jvndb-2016-000124

Vulnerability from jvndb

Published

2024-08-15 09:36

Modified

2024-08-15 09:36

Severity

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

WAON service app for Android fails to verify SSL server certificates

Details

WAON service app for Android provided by AEON CO., LTD. fails to verify SSL server certificates. Gaku Taniguchi of RiskFinder,inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type	URL
JVN	https://jvn.jp/en/jp/JVN68364327/index.html
CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4832
NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-4832
No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor	Product
AEON CO., LTD.	WAON service app

Show details on JVN DB website

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000124.html",
  "dc:date": "2024-08-15T09:36+09:00",
  "dcterms:issued": "2024-08-15T09:36+09:00",
  "dcterms:modified": "2024-08-15T09:36+09:00",
  "description": "WAON service app for Android provided by AEON CO., LTD. fails to verify SSL server certificates.\r\n\r\nGaku Taniguchi of RiskFinder,inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000124.html",
  "sec:cpe": {
    "#text": "cpe:/a:aeon:waon",
    "@product": "WAON service app",
    "@vendor": "AEON CO., LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000124",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN68364327/index.html",
      "@id": "JVN#68364327",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4832",
      "@id": "CVE-2016-4832",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2016-4832",
      "@id": "CVE-2016-4832",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "WAON service app for Android fails to verify SSL server certificates"
}

cve-2016-4832

Vulnerability from cvelistv5

Published

2017-04-21 14:00

Modified

2024-08-06 00:39

Severity

Summary

WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.

References

URL	Tags
http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000124.html	third-party-advisory, x_refsource_JVNDB
http://www.securityfocus.com/bid/91789	vdb-entry, x_refsource_BID
http://jvn.jp/en/jp/JVN68364327/index.html	third-party-advisory, x_refsource_JVN

Impacted products

Vendor	Product
n/a	n/a

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:39:26.362Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVNDB-2016-000124",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000124.html"
          },
          {
            "name": "91789",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91789"
          },
          {
            "name": "JVN#68364327",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN68364327/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-07-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WAON \"Service Application\" for Android 1.4.1 and earlier does not verify SSL certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-21T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVNDB-2016-000124",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000124.html"
        },
        {
          "name": "91789",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91789"
        },
        {
          "name": "JVN#68364327",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN68364327/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-4832",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WAON \"Service Application\" for Android 1.4.1 and earlier does not verify SSL certificates."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVNDB-2016-000124",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000124.html"
            },
            {
              "name": "91789",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91789"
            },
            {
              "name": "JVN#68364327",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN68364327/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2016-4832",
    "datePublished": "2017-04-21T14:00:00",
    "dateReserved": "2016-05-17T00:00:00",
    "dateUpdated": "2024-08-06T00:39:26.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.