CVE-2020-36285

Summary

CVE	CVE-2020-36285
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-04-06 16:15:00 UTC
Updated	2021-04-09 17:13:00 UTC
Description	Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.

Risk And Classification

Problem Types: CWE-347

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Unionpayintl	Union Pay	All	All	All	All

References

Reference	Source	Link	Tags
Dropbox - poc_code.py - Simplify your life	MISC	www.dropbox.com
Dropbox - UnionPay_Vulnerability_Report.txt - Simplify your life	MISC	www.dropbox.com
Please contact [email protected] to get access!	MISC	mobitec.ie.cuhk.edu.hk
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

630689 Union Pay For iOS Improper Verification of Cryptographic Signature Vulnerability
630715 Union Pay For iOS Improper Verification of Cryptographic Signature Vulnerability