CVE-2022-38117CWE-798
Juiker app - Hard-coded Credentials
Medium · published October 24, 2022
What it is
Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.
The record
Technical detail
- CVSS v3.1
- 5.5 · MEDIUM
- Vector
- CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00296 · 21.1th percentile
- Weakness
- CWE-798 · Use of Hard-coded Credentials
- Published
- 2022-10-24T13:21Z
EPSS history
Timeline