High severity · published Jan 28, 2020
CVE-2020-5523
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate…
7.4
CVSS
1.2%
EPSS
No
On KEV
Description
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
7B
77 Bank · 77bank
through 2.0.1 · source: NVD
AS
Ashigin · Ashikagabank
through 1.0.4 · source: NVD
DO
Dogin · Hokkaidobank
through 3.0.1 · source: NVD
HB
Hokuriku Bank Portal · Hokugin
through 2.0.1 · source: NVD
IS
Ikeda Senshu Bank · Sihd-bk
through 3.0.4 · source: NVD
MY
Mypallete · Nttdata
All versions, or not specified · source: NVD
NA
Nagagin · Naganobank
through 1.0.1 · source: NVD
SB
Shikoku Bank · Shikokubank
through 2.0.1 · source: NVD
TO
Tougin · Tohoku-bank
through 1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5523
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5523
Third Party Advisory
http://jvn.jp/en/jp/JVN28845872/index.html
Third Party Advisory
http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html
Third Party Advisory
https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf
Third Party Advisory
https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf
Third Party Advisory
https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf
Third Party Advisory
https://www.hokugin.co.jp/info/archives/personal/2020/1913.html