Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences.
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- TPC Software
- Product
- Matchpoint
- CVSS v4.0
- 6.9 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-256
- Exposure class
- Mobile OS, Database
- NVD status
- Deferred
Why it ranks 29 (Notable)
- CVSS v4.0 6.9 medium
- Product class: mobile OS, database
- Widely deployed vendor product (TPC Software)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.