CVE-2017-14487

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses…

mitre·CWE-290·Published 2017-12-01

CVSS

—

EPSS

0.01

KEV

Exploits

cve.orgen

276 chars

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.

NVDen

276 chars

NVDes

284 chars

La app OhMiBod Remote para Android e iOS permite que los atacantes remotos suplanten usuarios rastreando el tráfico de red para buscar respuestas del servidor de la API OhMiBod y luego editando los campos username, user_id y token en ata/data/com.ohmibod.remote2/shared_prefs/OMB.xml.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.4	10.0	4.9	AV:N/AC:L/Au:N/C:P/I:P/A:N
3.0	Primary	NVD	9.1	3.9	5.2	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N