CVE-2016-4839

CVE-2016-4839 Vulnerability Analysis & Exploit Intelligence

The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application.

Published May 12, 2017Updated Aug 6, 2024Sources: cvelistV5, jpcert

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

money foward

11 products listed

CVSS base

Unscored

no source published a base score

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

money foward sourcenext

Products (11)

money forwardmoney forward for the gunma bankmoney forward for shiga bankmoney forward for shizuoka bankmoney forward for sbi sumishin net bankmoney forward for tokai tokyo securitiesmoney forward for the toho bankmoney forward for ymfgmoney forward for apppassmoney forward for au smartpassmoney forward for chou houdai

References

4 on the record

www.sourcenext.com/support/i/160725_1
x_refsource_MISC
www.securityfocus.com/bid/93035
vdb-entry, x_refsource_BID
corp.moneyforward.com/info/20160920-mf-android/
x_refsource_CONFIRM
jvn.jp/en/jp/JVN61297210/index.html
third-party-advisory, x_refsource_JVN

Elsewhere on this site

money fowardevery CVE for this vendor
sourcenextevery CVE for this vendor

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.