Unscored severity · published Jul 26, 2012
CVE-2012-3888
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data
–
CVSS
1.4%
EPSS
No
On KEV
Description
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Airdroid · Airdroid
1.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3888
Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-07/0087.html
Exploit
http://www.tele-consulting.com/advisories/TC-SA-2012-02.txt
More from Airdroid
7.5
CVE-2019-9599
The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite_auth/ requests
–
CVE-2015-5661
The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application
–
CVE-2013-0134
Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via a crafted text message that is…
–
CVE-2012-3887
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain…
–
CVE-2012-3886
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by…