{"containers": {"cna": {"affected": [{"product": "Studyplus App", "vendor": "Studyplus Inc.", "versions": [{"status": "affected", "version": "for Android v6.3.7 and earlier, and for iOS v8.29.0 and earlier"}]}], "descriptions": [{"lang": "en", "value": "Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."}], "problemTypes": [{"descriptions": [{"description": "Use of Hard-coded Credentials", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-11-06T02:06:32", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN00414047/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2020-5667", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Studyplus App", "version": {"version_data": [{"version_value": "for Android v6.3.7 and earlier, and for iOS v8.29.0 and earlier"}]}}]}, "vendor_name": "Studyplus Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use of Hard-coded Credentials"}]}]}, "references": {"reference_data": [{"name": "https://jvn.jp/en/jp/JVN00414047/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN00414047/index.html"}]}}}}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2020-5667", "datePublished": "2020-11-06T02:06:32", "dateReserved": "2020-01-06T00:00:00", "dateUpdated": "2020-11-06T02:06:32", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wantedlyinc:studyplus:*:*:*:*:*:android:*:*", "matchCriteriaId": "1F8A4885-F83A-4364-8ADF-96E1109C215B", "versionEndIncluding": "6.3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wantedlyinc:studyplus:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "A4BC2E3B-846A-4F4A-A56D-8AD085B3D84E", "versionEndIncluding": "8.29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."}, {"lang": "es", "value": "La aplicaci\u00f3n Studyplus para Android versiones v6.3.7 y anteriores y la aplicaci\u00f3n Studyplus para iOS versiones v8.29.0 y anteriores, usan una clave API embebida para un servicio externo. Al explotar esta vulnerabilidad, la clave API para un servicio externo puede ser obtenida mediante el an\u00e1lisis de los datos en la aplicaci\u00f3n"}], "id": "CVE-2020-5667", "lastModified": "2020-11-17T14:02:22.757", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-06T03:15:17.777", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN00414047/index.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}