CVE-2018-0591 The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o...
MediumCVSS 5.9
EPSS 0.82%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| t-joy kinepass | <= 3.1.1 | No fix listed |
| t-joy kinepass | <= 3.1.2 | No fix listed |
| t-joy KINEPASS App | = for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier | No fix listed |
References
- itunes.apple.com third-party-advisory
- JVN#83671755 third-party-advisory vdb-entry
- play.google.com third-party-advisory