CVEvulnerability

CVE-2020-5523

7.4 HIGH Published 2020-01-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-295

Description

Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected configurations

• 77bank 77 bank (<= 2.0.1) • ashikagabank ashigin (<= 1.0.4) • hokkaidobank dogin (<= 3.0.1) • hokugin hokuriku bank portal (<= 2.0.1) • naganobank nagagin (<= 1.0.1) • nttdata mypallete • shikokubank shikoku bank (<= 2.0.1) • sihd-bk ikeda senshu bank (<= 3.0.4) • tohoku-bank tougin (<= 1.0.1)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References