2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"Studyplus App","vendor":"Studyplus Inc.","versions":[{"status":"affected","version":"for Android v6.3.7 and earlier, and for iOS v8.29.0 and earlier"}]}],"source":"vultures@jpcert.or.jp"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wantedlyinc:studyplus:*:*:*:*:*:android:*:*","matchCriteriaId":"1F8A4885-F83A-4364-8ADF-96E1109C215B","versionEndIncluding":"6.3.7","vulnerable":true},{"criteria":"cpe:2.3:a:wantedlyinc:studyplus:*:*:*:*:*:iphone_os:*:*","matchCriteriaId":"A4BC2E3B-846A-4F4A-A56D-8AD085B3D84E","versionEndIncluding":"8.29.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."},{"lang":"es","value":"La aplicación Studyplus para Android versiones v6.3.7 y anteriores y la aplicación Studyplus para iOS versiones v8.29.0 y anteriores, usan una clave API embebida para un servicio externo. Al explotar esta vulnerabilidad, la clave API para un servicio externo puede ser obtenida mediante el análisis de los datos en la aplicación"}],"id":"CVE-2020-5667","lastModified":"2026-06-17T03:22:03.980","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"NONE","baseScore":2.1,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":3.9,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-11-06T03:15:17.777","references":[{"source":"vultures@jpcert.or.jp","tags":["Third Party Advisory"],"url":"https://jvn.jp/en/jp/JVN00414047/index.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://jvn.jp/en/jp/JVN00414047/index.html"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"nvd@nist.gov","type":"Primary"}]}
|