Information disclosure in Airdroid

CVE-2012-3886

AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table attack.

Vulnerability class: Information Disclosure

EPSS: 0.013 (66.7th percentile) — read the EPSS interpretation.

Affected products

  • Airdroid — versions 1.0.4
  • N/a — versions n/a

Weakness classification (CWE)

References