CVE-2020-5523
HIGHCVSS 7.4/10EPSS 1.18%
Last modified
CVE-2020-5523 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.. EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 77bank | 77 Bank | <= 2.0.1 |
| Ashikagabank | Ashigin | <= 1.0.4 |
| Hokkaidobank | Dogin | <= 3.0.1 |
| Hokugin | Hokuriku Bank Portal | <= 2.0.1 |
| Naganobank | Nagagin | <= 1.0.1 |
| Nttdata | Mypallete | All versions |
| Shikokubank | Shikoku Bank | <= 2.0.1 |
| Sihd-Bk | Ikeda Senshu Bank | <= 3.0.4 |
| Tohoku-Bank | Tougin | <= 1.0.1 |
References
- http://jvn.jp/en/jp/JVN28845872/index.htmlThird Party Advisory
- http://www.dokodemobank.ne.jp/info_20200128_bankingapp.htmlThird Party Advisory
- https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdfThird Party Advisory
- https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdfThird Party Advisory
- https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdfThird Party Advisory
- https://www.hokugin.co.jp/info/archives/personal/2020/1913.htmlThird Party Advisory
- https://www.naganobank.co.jp/soshiki/2/app-ssl.htmlThird Party Advisory
- https://www.shikokubank.co.jp/info/apps20200128.htmlThird Party Advisory
- https://www.sihd-bk.jp/common_v2/pdf/20200127.pdfThird Party Advisory
- https://www.tohoku-bank.co.jp/news/topics/200128_applissl.htmlThird Party Advisory
- http://jvn.jp/en/jp/JVN28845872/index.htmlThird Party Advisory
- http://www.dokodemobank.ne.jp/info_20200128_bankingapp.htmlThird Party Advisory
- https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdfThird Party Advisory
- https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdfThird Party Advisory
- https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdfThird Party Advisory
- https://www.hokugin.co.jp/info/archives/personal/2020/1913.htmlThird Party Advisory
- https://www.naganobank.co.jp/soshiki/2/app-ssl.htmlThird Party Advisory
- https://www.shikokubank.co.jp/info/apps20200128.htmlThird Party Advisory
- https://www.sihd-bk.jp/common_v2/pdf/20200127.pdfThird Party Advisory
- https://www.tohoku-bank.co.jp/news/topics/200128_applissl.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5523?
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
How severe is CVE-2020-5523?
CVE-2020-5523 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 1.18% probability of exploitation in the next 30 days.
How do I fix CVE-2020-5523?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5515Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.7.2
- CVE-2020-5517CSRF in the /login URI in BlueOnyx 5209R allows an attacker …6.5
- CVE-2020-5519The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not…9.8
- CVE-2020-5520The netprint App for iOS 3.2.3 and earlier does not verify X…7.4
- CVE-2020-5521The kantan netprint App for iOS 2.0.2 and earlier does not v…7.4
- CVE-2020-5522The kantan netprint App for Android 2.0.3 and earlier does n…7.4
- CVE-2020-5524Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, A…8.8
- CVE-2020-5525Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, A…8
- CVE-2020-5526The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2…5.9
- CVE-2020-5527When MELSOFT transmission port (UDP/IP) of Mitsubishi Electr…7.5
- CVE-2020-5528Cross-site scripting vulnerability in Movable Type series (M…6.1
- CVE-2020-5529HtmlUnit prior to 2.37.0 contains code execution vulnerabili…8.1
Are you affected by CVE-2020-5523?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST