CVE-2016-6548
Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token
- State
- Published
- Severity
- Not scored
- Published
- Jul 13, 2018
- Updated
- Aug 6, 2024
- Reserved
- Aug 3, 2016
Description
The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account.
Scores
The record has no CVSS score.
Weaknesses
- CWE-200 Information Exposure
Affected Products
| Product | Versions |
|---|---|
Tech Nut Mobile ApplicationZizai Technology |
|
References
- 93877vdb-entry
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
- VU#402847third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.