jvndb-2018-000047
Vulnerability from jvndb
Published
2018-05-11 14:34
Modified
2019-12-27 18:11
Severity
Summary
IIJ SmartKey App for Android vulnerable to authentication bypass
Details
IIJ SmartKey App for Android contains an authentication bypass vulnerability.
IIJ SmartKey App for Android provided by Internet Initiative Japan Inc. is an application that enables two-step authentication (two-factor authentication) for a website from an Android device. IIJ SmartKey App for Android contains an authentication bypass vulnerability (CWE-287).
Ryo Tateguchi of AndroPlus reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL |
|---|---|
| JVN | http://jvn.jp/en/jp/JVN27137002/index.html |
| CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0584 |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2018-0584 |
| Improper Authentication(CWE-287) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
| Vendor | Product |
|---|---|
| Internet Initiative Japan Inc. | IIJ SmartKey |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000047.html",
"dc:date": "2019-12-27T18:11+09:00",
"dcterms:issued": "2018-05-11T14:34+09:00",
"dcterms:modified": "2019-12-27T18:11+09:00",
"description": "IIJ SmartKey App for Android contains an authentication bypass vulnerability.\r\n\r\nIIJ SmartKey App for Android provided by Internet Initiative Japan Inc. is an application that enables two-step authentication (two-factor authentication) for a website from an Android device. IIJ SmartKey App for Android contains an authentication bypass vulnerability (CWE-287).\r\n\r\nRyo Tateguchi of AndroPlus reported this vulnerability to IPA.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000047.html",
"sec:cpe": {
"#text": "cpe:/a:iij:iij_smartkey",
"@product": "IIJ SmartKey",
"@vendor": "Internet Initiative Japan Inc.",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "2.6",
"@severity": "Low",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"@version": "2.0"
},
{
"@score": "3.3",
"@severity": "Low",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2018-000047",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN27137002/index.html",
"@id": "JVN#27137002",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0584",
"@id": "CVE-2018-0584",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0584",
"@id": "CVE-2018-0584",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-287",
"@title": "Improper Authentication(CWE-287)"
}
],
"title": "IIJ SmartKey App for Android vulnerable to authentication bypass"
}
Loading...