CVE-2024-12094: Information Disclosure Vulnerability in Tinxy

Published Dec 5, 2024

Updated

This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.

Affected Software

1 affected component

Tinxy Tinxy

Remediation

Information

Upgrade Tinxy Andriod app to version 663000 and iOS app to version 6.7.0 https://play.google.com/store/apps/details?id=com.tinxy https://apps.apple.com/in/app/tinxy/id1387370719 https://play.google.com/store/apps/details

Event History

Dec 5, 2024

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-12094?

CVE-2024-12094 has a high severity rating due to the exposure of sensitive user information.

How do I fix CVE-2024-12094?

To fix CVE-2024-12094, ensure that user information is stored securely, using encryption instead of plaintext.

Who is affected by CVE-2024-12094?

Users of the Tinxy mobile app are affected by CVE-2024-12094 if their device is rooted.

What type of data is exposed in CVE-2024-12094?

CVE-2024-12094 exposes logged-in user information stored in plaintext within the device database.

Can CVE-2024-12094 be exploited remotely?

No, CVE-2024-12094 requires physical access to the rooted device for exploitation.