CVE-2019-13096 - TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage

Back Back to CVE browser

CRITICAL

TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage

Published Jul 22, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.14%

Description

TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/<wallet-name>.xml to gain unauthorized access.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-312

References (2)

https://pastebin.com/raw/08REmV1X
x_refsource_MISCExploitThird Party Advisory
https://pastebin.com/raw/J9B8Lh0j
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://pastebin.com/raw/08REmV1X		x_refsource_MISCExploitThird Party Advisory
https://pastebin.com/raw/J9B8Lh0j		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 22, 2019

Updated Aug 4, 2024

Reserved Jun 30, 2019

Link CVE-2019-13096

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-13096

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-13096