CVE-2018-15661 - An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android

Back Back to CVE browser

HIGH

An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android

Published Aug 21, 2018

7.5

HIGH

CVSS 3.0

EPSS 1.23%

Description

An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-7532
Advisory
https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-7532		Advisory
https://github.com/magicj3lly/appexploits/blob/master/OLA%20Money.pdf		x_refsource_MISCThird Party Advisory