CVE-2019-6024

MEDIUM

Rakuten Rakuma < 7.15.0 - Insufficiently Protected Credentials

Title source: rule

Description

Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and obtain the user's authentication information via a malicious application created by the third party.

References (3)

[Third Party Advisory, VDB Entry] http://jvn.jp/en/jp/JVN41566067/index.html

[Product, Release Notes] https://apps.apple.com/jp/app/furimaapuri-furiru-fril-fasshon/id523497998

[Product] https://play.google.com/store/apps/details?id=jp.co.fablic.fril&hl=en

Scores

CVSS v3 6.5

EPSS 0.0035

EPSS Percentile 56.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE

CWE-522

Status published

Affected Products (2)

rakuten/rakuma < 7.15.0

rakuten/rakuma < 7.16.4

Timeline

Published Dec 26, 2019

Tracked Since Feb 18, 2026