CVE-2017-14487
Last modified
CVE-2017-14487 is a vulnerability of currently unknown severity. The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.. EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ohmibod | Ohmibod Remote | < 2.50.37 |
References
- https://dl.acm.org/citation.cfm?id=3139942&preflayout=flatIssue Tracking, Third Party Advisory
- https://dl.acm.org/citation.cfm?id=3139942&preflayout=flatIssue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14487?
How severe is CVE-2017-14487?
How do I fix CVE-2017-14487?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14480In the MMM::Agent::Helpers::Network::clear_ip function in My…9.8
- CVE-2017-14481In the MMM::Agent::Helpers::Network::send_arp function in My…9.8
- CVE-2017-14482GNU Emacs before 25.3 allows remote attackers to execute arb…
- CVE-2017-14483flower.initd in the Gentoo dev-python/flower package before …
- CVE-2017-14484The Gentoo sci-mathematics/gimps package before 28.10-r1 for…
- CVE-2017-14486The Vibease Wireless Remote Vibrator app for Android and the…
- CVE-2017-14489The iscsi_if_rx function in drivers/scsi/scsi_transport_iscs…
- CVE-2017-1449IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote atta…
- CVE-2017-14491Heap-based buffer overflow in dnsmasq before 2.78 allows rem…9.8
- CVE-2017-14492Heap-based buffer overflow in dnsmasq before 2.78 allows rem…
- CVE-2017-14493Stack-based buffer overflow in dnsmasq before 2.78 allows re…
- CVE-2017-14494dnsmasq before 2.78, when configured as a relay, allows remo…
Are you affected by CVE-2017-14487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST