Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Union_pay | Unionpayintl | * | 3.3.12 (including) |