CVE-2018-18976

An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)

Score

CVSS 3.0 5.3 Medium

Status

Modified - cve@mitre.org

Published

2019-05-06

Last modified

2024-08-05

Weaknesses

CWE-639

Affected products

• Contour Diabetes (Ascensia)

References

• https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic