CVE-2019-13098 Information disclosure in n/a
TronLink Wallet logs user passwords during registration, allowing other apps or users to read them via Logcat, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13098?
CVE-2019-13098 is a medium-severity vulnerability in n/a, published on 22 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.
Weakness: CWE-532
Which versions are affected by CVE-2019-13098?
It affects 1 product.
Products include Tronlink Wallet.
How do I fix CVE-2019-13098?
No fix has been published for CVE-2019-13098 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13098 being exploited?
There is no known exploitation of CVE-2019-13098 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fhc3-6cc5-9wm2.