Vulnerability in Good For Enterprise
CVE-2015-9232
The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.009 (58.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Good For Enterprise — versions 3.0.0.415
Weakness classification (CWE)
References
- community.blackberry.com/community/blogs/blog/2015/10/02/what-you-need-to-know-… (Third Party Advisory)
- www.modzero.ch/advisories/MZ-15-03-GOOD-Auth-Delegation.txt (Exploit, Third Party Advisory, Mitigation)
- www.securityfocus.com/archive/1/536543 (Exploit, VDB Entry, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2015-9232?
- CVE-2015-9232 is a medium-severity vulnerability in Good For Enterprise, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.3/10. Published 2017-09-20.
- How severe is CVE-2015-9232?
- Medium severity. CVSS v3 base score is 5.3 out of 10.