CVE-2017-9820

The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to the Accessibility service, which makes it easier for attackers to bypass authentication.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-08-24

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Bharat Interface For Money (bhim) (Npci)

References

• https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148925