Local Information Disclosure in Envoy Passport for Android and iPhone

CVE-2018-17499

What is CVE-2018-17499?

The Envoy Passport for both Android and iPhone is vulnerable due to improper handling of sensitive data, specifically the storage of unencrypted information in log files. This flaw allows a local attacker to access sensitive data including two API keys, a token, and other private information, potentially leading to further exploits or unauthorized access.

References