CVE-2022-38117
Assigner: twcert
Published: 2022-10-24T00:00:00
State: PUBLISHED
title: Juiker app - Hard-coded Credentials
datePublic: 2022-10-24T00:00:00
descriptions: value: Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.
affected: vendor: Juiker
product: Juiker app
versions: version: 4.6.0311.1
status: affected
credits: value: RayHong (CCoE)
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-798 Use of Hard-coded Credentials
cweId: CWE-798
x_generator: engine: Vulnogram 0.0.9
source: advisory: TVN-202208002
discovery: EXTERNAL
solutions: value: Update Juiker app version to 4.6.0915.1