CVE Vulnerabilities

CVE-2022-40703

Authentication Bypass by Assumed-Immutable Data

Published: Oct 26, 2022 | Modified: Nov 21, 2024
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App versionĀ 5.17.1-754993421 and prior

on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app.

Weakness

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Affected Software

Name Vendor Start Version End Version
Kardia Alivecor * 5.17.1-754993421 (including)

Potential Mitigations

References