« Volver al listado

CVE-2024-39886

Estado: AplazadaBaja (3.7)—

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tone — Store APPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39886",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39886",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-10T13:40:10.688127Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "DREAM TRAIN INTERNET INC.",
          "product": "TONE store App",
          "versions": [
            {
              "status": "affected",
              "version": "version 3.4.2 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-07-10T07:15:03.247",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN28515217/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://tone.ne.jp/vulnerability/14492007.html",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN28515217/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tone.ne.jp/vulnerability/14492007.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-419"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App."
    },
    {
      "lang": "es",
      "value": "La versión 3.4.2 y anteriores de la aplicación TONE store contiene un problema con el canal principal desprotegido. Dado que la aplicación TONE store se comunica con el sitio web de TONE store en texto plano, un ataque man-in-the-middle puede permitir a un atacante obtener y/o alterar las comunicaciones de la aplicación afectada."
    }
  ],
  "lastModified": "2026-06-17T07:42:58.123",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}