Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Union_pay | Unionpayintl | * | 3.4.93.4.9 (including) |