CVE-2023-22367 Weak cryptography in Ichiran App for iOS and Ichiran App for Android
Attackers can intercept encrypted traffic via man-in-the-middle attacks due to improper certificate validation in the Ichiran mobile app.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22367?
CVE-2023-22367 is a medium-severity vulnerability in Betrend Corporation and ICHIRAN INC. Ichiran App for iOS and Ichiran App for Android, published on 13 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
Weakness: CWE-295
Which versions are affected by CVE-2023-22367?
It affects 1 product.
Products include Ichiranusa Ichiran.
How do I fix CVE-2023-22367?
No fix has been published for CVE-2023-22367 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22367 being exploited?
There is no known exploitation of CVE-2023-22367 in the wild and no public exploit code.
Sources
Also known as GHSA-g9vx-qcqw-wcpx.