CVE-2018-17500: High severity Envoy Passport Iphone Os vulnerability
Published Mar 19, 2019
·Updated
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.
Affected Software
2 affected components
Envoy Passport Iphone Os=2.2.5
Envoy Passport Android=2.4.0
Event History
Mar 19, 2019
CVE Published
via MITRE·07:47 PM
Data Sourced
via MITRE·07:47 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-17500?
CVE-2018-17500 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.
2
How do I fix CVE-2018-17500?
To fix CVE-2018-17500, update Envoy Passport to the latest version where this issue has been addressed.
3
What types of devices are affected by CVE-2018-17500?
CVE-2018-17500 affects Envoy Passport for Android and iPhone with specific versions 2.2.5 and 2.4.0.
4
What type of information may be exposed due to CVE-2018-17500?
CVE-2018-17500 may expose hardcoded OAuth credentials stored in plaintext.
5
Can CVE-2018-17500 be exploited remotely?
CVE-2018-17500 requires local access to the device, thus it cannot be exploited remotely.