CVE-2018-12446

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-12446
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred

3.6 /10

CVSS v3 : LOW

V3 Legend

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability : 1.0 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 3.4 / Impact : 4.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://gist.github.com/tanprathan/97b4c04ec6af4da62929e73214fddd1b Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dropbox:dropbox:98.2.2:*:*:*:*:android:*:*
History

07 Nov 2023, 02:52

Type Values Removed Values Added
Summary ** DISPUTED ** An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred. An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Information

Published : 2018-06-20 12:29

Updated : 2024-04-11 01:00

NVD link : CVE-2018-12446

Mitre link : CVE-2018-12446

CVE.ORG link : CVE-2018-12446

JSON object : View

Products Affected

dropbox

  • dropbox
CWE
CWE-287

Improper Authentication