CVE-2022-38117 - Vulnerability Details - OpenCVE

ReportizFlow

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Juiker	Juiker

Configuration 1 [-]

cpe:2.3:a:juiker:juiker:4.6.0311.1:*:*:*:*:android:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2022-10-24T13:21:03.691129Z

Updated: 2024-09-16T19:21:12.238Z

Reserved: 2022-08-10T00:00:00

Link: CVE-2022-38117

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-24T14:15:50.863

Modified: 2024-11-21T07:15:49.673

Link: CVE-2022-38117

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:juiker:juiker:4.6.0311.1:*:*:*:*:android:*:*", "matchCriteriaId": "70D4534E-BD1E-4391-8304-6501024FE375", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users\u2019 ciphertext and tamper with it."}, {"lang": "es", "value": "La aplicaci\u00f3n Juiker embebe su clave AES en el c\u00f3digo fuente. Un atacante f\u00edsico, despu\u00e9s de conseguir el privilegio de root de Android, puede usar la clave AES para descifrar el texto cifrado de usuarios y manipularlo"}], "id": "CVE-2022-38117", "lastModified": "2024-11-21T07:15:49.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 5.2, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-10-24T14:15:50.863", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "[email protected]", "type": "Primary"}]}