Headline
CVE-2022-29482: Mobaoku-Auction & Flea Market App for iOS vulnerable to improper server certificate verification
‘Mobaoku-Auction&Flea Market’ App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
Published:2022/05/27 Last Updated:2022/05/27
Overview
Mobaoku-Auction & Flea Market App for iOS is vulnerable to improper server certificate verification.
Products Affected
- Mobaoku-Auction & Flea Market App for iOS versions prior to 5.5.16
Description
Mobaoku-Auction & Flea Market App for iOS provided by DeNA Co., Ltd. is vulnerable to improper server certificate verification (CWE-295).
Impact
A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication.
Solution
Update the application
Update the application to the latest version according to the information provided by the developer.
The developer released the following version that fixes the vulnerability on February 21, 2022:
- Mobaoku-Auction & Flea Market App for iOS version 5.5.16
Vendor Status
Vendor
Status
Last Update
Vendor Notes
DeNA Co., Ltd.
Vulnerable
2022/05/27
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector(AV)
Physical §
Local (L)
Adjacent (A)
Network (N)
Attack Complexity(AC)
High (H)
Low (L)
Privileges Required(PR)
High (H)
Low (L)
None (N)
User Interaction(UI)
Required ®
None (N)
Scope(S)
Unchanged (U)
Changed ©
Confidentiality Impact©
None (N)
Low (L)
High (H)
Integrity Impact(I)
None (N)
Low (L)
High (H)
Availability Impact(A)
None (N)
Low (L)
High (H)
CVSS v2 AV:N/AC:H/Au:N/C:P/I:P/A:N
Access Vector(AV)
Local (L)
Adjacent Network (A)
Network (N)
Access Complexity(AC)
High (H)
Medium (M)
Low (L)
Authentication(Au)
Multiple (M)
Single (S)
None (N)
Confidentiality Impact©
None (N)
Partial §
Complete ©
Integrity Impact(I)
None (N)
Partial §
Complete ©
Availability Impact(A)
None (N)
Partial §
Complete ©
Comment
This analysis assumes a man-in-the-middle attack being conducted by an attacker that places a malicious wireless LAN access point.
Credit
Okazawa Yoshihiro reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information