« Volver al listado

CVE-2018-0591

Estado: ModificadaMedia (5.9)—

La app KINEPASS para Android en versiones 3.1.1 y anteriores y para iOS en versiones 3.1.2 y anteriores, no verifica los certificados X.509 desde los servidores SSL, lo que permite a los atacantes Man-in-the-Middle (MitM) suplantar servidores y obtener información sensible mediante un certificado manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

T-joy — Kinepass

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-0591",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "T-JOY CO.,LTD.",
          "product": "KINEPASS App",
          "versions": [
            {
              "status": "affected",
              "version": "for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-14T13:29:03.447",
  "references": [
    {
      "url": "https://itunes.apple.com/us/app/kinepasu-apuridekantan-bian/id637453055?mt=8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN83671755/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://play.google.com/store/apps/details?id=jp.tjoy.kinepass&hl=en",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://itunes.apple.com/us/app/kinepasu-apuridekantan-bian/id637453055?mt=8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN83671755/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://play.google.com/store/apps/details?id=jp.tjoy.kinepass&hl=en",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
    },
    {
      "lang": "es",
      "value": "La app KINEPASS para Android en versiones 3.1.1 y anteriores y para iOS en versiones 3.1.2 y anteriores, no verifica los certificados X.509 desde los servidores SSL, lo que permite a los atacantes Man-in-the-Middle (MitM) suplantar servidores y obtener información sensible mediante un certificado manipulado."
    }
  ],
  "lastModified": "2026-06-17T01:31:15.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:t-joy:kinepass:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "366445B9-01E2-4ED1-A230-1B89DE8EE02D",
              "versionEndIncluding": "3.1.1"
            },
            {
              "criteria": "cpe:2.3:a:t-joy:kinepass:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AFB794B-EC1E-4D19-B077-5F80FB6EF29A",
              "versionEndIncluding": "3.1.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}