Lucene search

[email protected]NVD:CVE-2016-4839

HistoryMay 12, 2017 - 6:29 p.m.

CVE-2016-4839

2017-05-1218:29:00

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

41.8%

JSON

The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application.

Affected configurations

Nvd

Node

moneyforwardmoney_forward_for_apppassRange<7.18.3android

moneyforwardmoney_forward_for_au_smartpassRange<7.18.0android

moneyforwardmoney_forward_for_chou_houdaiRange<7.18.3android

moneyforwardmoney_forward_for_sbi_sumishin_net_bankRange<1.6.0android

moneyforwardmoney_forward_for_shiga_bankRange<1.2.0android

moneyforwardmoney_forward_for_shizuoka_bankRange<1.4.0android

moneyforwardmoney_forward_for_the_gunma_bankRange<1.2.0android

moneyforwardmoney_forward_for_the_toho_bankRange<1.3.0android

moneyforwardmoney_forward_for_tokai_tokyo_securitiesRange<1.4.0android

moneyforwardmoney_forward_for_ymfgRange<1.5.0android

VendorProductVersionCPE
moneyforwardmoney_forward_for_apppass*cpe:2.3:a:moneyforward:money_forward_for_apppass:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_au_smartpass*cpe:2.3:a:moneyforward:money_forward_for_au_smartpass:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_chou_houdai*cpe:2.3:a:moneyforward:money_forward_for_chou_houdai:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_sbi_sumishin_net_bank*cpe:2.3:a:moneyforward:money_forward_for_sbi_sumishin_net_bank:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_shiga_bank*cpe:2.3:a:moneyforward:money_forward_for_shiga_bank:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_shizuoka_bank*cpe:2.3:a:moneyforward:money_forward_for_shizuoka_bank:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_the_gunma_bank*cpe:2.3:a:moneyforward:money_forward_for_the_gunma_bank:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_the_toho_bank*cpe:2.3:a:moneyforward:money_forward_for_the_toho_bank:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_tokai_tokyo_securities*cpe:2.3:a:moneyforward:money_forward_for_tokai_tokyo_securities:*:*:*:*:*:android:*:*
moneyforwardmoney_forward_for_ymfg*cpe:2.3:a:moneyforward:money_forward_for_ymfg:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
moneyforward	money_forward_for_apppass	*	cpe:2.3:a:moneyforward:money_forward_for_apppass::::::android::*
moneyforward	money_forward_for_au_smartpass	*	cpe:2.3:a:moneyforward:money_forward_for_au_smartpass::::::android::*
moneyforward	money_forward_for_chou_houdai	*	cpe:2.3:a:moneyforward:money_forward_for_chou_houdai::::::android::*
moneyforward	money_forward_for_sbi_sumishin_net_bank	*	cpe:2.3:a:moneyforward:money_forward_for_sbi_sumishin_net_bank::::::android::*
moneyforward	money_forward_for_shiga_bank	*	cpe:2.3:a:moneyforward:money_forward_for_shiga_bank::::::android::*
moneyforward	money_forward_for_shizuoka_bank	*	cpe:2.3:a:moneyforward:money_forward_for_shizuoka_bank::::::android::*
moneyforward	money_forward_for_the_gunma_bank	*	cpe:2.3:a:moneyforward:money_forward_for_the_gunma_bank::::::android::*
moneyforward	money_forward_for_the_toho_bank	*	cpe:2.3:a:moneyforward:money_forward_for_the_toho_bank::::::android::*
moneyforward	money_forward_for_tokai_tokyo_securities	*	cpe:2.3:a:moneyforward:money_forward_for_tokai_tokyo_securities::::::android::*
moneyforward	money_forward_for_ymfg	*	cpe:2.3:a:moneyforward:money_forward_for_ymfg::::::android::*

References

corp.moneyforward.com/info/20160920-mf-android/

www.securityfocus.com/bid/93035

www.sourcenext.com/support/i/160725_1

jvn.jp/en/jp/JVN61297210/index.html

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

41.8%

JSON

Related for NVD:CVE-2016-4839

cvelist1 jvn1 cve1 prion1