CVE-2017-3776 Information disclosure in Help mobile Android app
Attackers can intercept sensitive data transmitted over unencrypted HTTP channels in the Lenovo Help Android app.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3776?
CVE-2017-3776 is a high-severity vulnerability in Lenovo Group Ltd. Help mobile Android app, published on 19 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the channel to potentially see this information.
Weakness: CWE-200
Which versions are affected by CVE-2017-3776?
It affects 1 product.
Products include Lenovo Lenovo Help.
How do I fix CVE-2017-3776?
No fix has been published for CVE-2017-3776 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-3776 being exploited?
There is no known exploitation of CVE-2017-3776 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Group Ltd. Help mobile Android app
Sources
Also known as GHSA-7hqw-2fxf-q78w.