Main Vulnerability Database Vulnerabilities #VU24687

Improper Certificate Validation in THE NAGANO BANK, LTD. products - CVE-2020-5523

Published: January 28, 2020

Vulnerability identifier: #VU24687

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5523

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a man-in-the-middle attack.

The vulnerability exists due to the Android App "MyPallete" and some of the Android banking applications based on "MyPallete" fail to verify SSL server certificates and also do not properly validate certificates with host-mismatch. A remote attacker can supply a specially crafted SSL certificate, perform a man-in-the-middle attack and eavesdrop on an encrypted communication.

Affected software

Ashigin app
Hokuriku Bank Portal App
Ikeda Senshu Bank Banking App
Dogin app
Shikoku Bank App
77 Bank Application
Tougin app
MyPallete
Nagagin app

How to mitigate CVE-2020-5523

Install updates from vendor's website released on January 28, 2020.

Ashigin app - update to 1.0.5
Hokuriku Bank Portal App - update to 2.0.2
Ikeda Senshu Bank Banking App - update to 3.0.5
Dogin app - update to 3.0.2
Shikoku Bank App - update to 2.0.2
77 Bank Application - update to 2.0.3
Tougin app - update to 1.0.2
Nagagin app - update to 2.0.0

External References

Related Security Bulletins

Improper Certificate Validation in MyPallete app for Android