Vulnerability in 77bank 77 Bank
CVE-2020-5523
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.012 (66.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- 77bank 77 Bank
- Ashikagabank Ashigin
- Hokkaidobank Dogin
- Hokugin Hokuriku Bank Portal
- Naganobank Nagagin
- Nttdata Mypallete
- Ntt Data Corporation 'Mypallete' And Some Of The Android Banking Applications That Use — versions MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier
- Shikokubank Shikoku Bank
- Sihd-Bk Ikeda Senshu Bank
- Tohoku-Bank Tougin
Weakness classification (CWE)
References
- www.dokodemobank.ne.jp/info_20200128_bankingapp.html (Third Party Advisory)
- www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf (Third Party Advisory)
- www.sihd-bk.jp/common_v2/pdf/20200127.pdf (Third Party Advisory)
- www.shikokubank.co.jp/info/apps20200128.html (Third Party Advisory)
- www.tohoku-bank.co.jp/news/topics/200128_applissl.html (Third Party Advisory)
- www.naganobank.co.jp/soshiki/2/app-ssl.html (Third Party Advisory)
- www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf (Third Party Advisory)
- www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf (Third Party Advisory)
- www.hokugin.co.jp/info/archives/personal/2020/1913.html (Third Party Advisory)
- jvn.jp/en/jp/JVN28845872/index.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-5523?
- CVE-2020-5523 is a high-severity vulnerability in 77bank 77 Bank, classified under Improper Certificate Validation. CVSS score: 7.4/10. Published 2020-01-28.
- How severe is CVE-2020-5523?
- High severity. CVSS v3 base score is 7.4 out of 10.