Vulnerability in Good For Enterprise
CVE-2015-9232
The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.
EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Good Good_for_enterprise — versions 3.0.0.415
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Mitigation)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC, Mitigation)
Frequently asked questions
- What is CVE-2015-9232?
- CVE-2015-9232 is a medium-severity vulnerability in Good For Enterprise, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.3/10. Published 2017-09-20.
- How severe is CVE-2015-9232?
- Medium severity. CVSS v3 base score is 5.3 out of 10.