Authentication Bypass Vulnerability in Dropbox Android App
CVE-2018-12446

3.6LOW

Key Information:

Vendor

Dropbox

Status
Dropbox
Vendor
CVE Published:
20 June 2018

What is CVE-2018-12446?

An authentication bypass vulnerability exists in the Dropbox application for Android version 98.2.2. The issue is linked to the Passcode feature, which is susceptible to runtime manipulation. By forcing a certain method's return value to true, an attacker can bypass authentication, allowing them to log in using any arbitrary passcode. It's important to note that Dropbox has indicated this attack vector is not a concern within their threat model for devices that have been rooted.

References

https://gist.github.com/tanprathan/97b4c04ec6af4da62929e7...
x_refsource_MISC

CVSS V3.1

Score:
3.6
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.