Description

A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/com/rico/mobile/di/SegmentSettingsModule.java of the component br.com.rico.mobile. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key . The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Type de vulnérabilité

• CWE-320
• CWE-321

Vecteur d'attaque

Complexité : LOW

Privilèges requis : LOW

Interaction utilisateur : NONE

Impact

• Confidentialité : LOW
• Intégrité : NONE
• Disponibilité : NONE

Recommandations

Appliquer les correctifs de sécurité fournis par le vendeur dès que possible.