PT-2018-4939

CVE-2016-6538

Publicado

2018-07-06

Atualizado

2019-10-09

Descrição por

CVSS 2.0

3.3

Baixa

MétricasAV:A/AC:L/Au:N/C:P/I:N/A:N

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adam Compton

Deral Heiland

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-313: Cleartext Storage in a File or on Disk