Vulnerability · Published Dec 5, 2024 · Assigned by CERT-In

CVE-2024-12094Information Disclosure Vulnerability in Tinxy

Medium 5.4

In plain English

A medium-severity security flaw in Tinxy Android app from Mogify Infotech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 4.0)5.4Medium

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.

Affected products (as reported)

Vendor	Product	Versions
Mogify Infotech	Tinxy Android app	<663000
Mogify Infotech	Tinxy iOS app	<6.7.0

Weakness: CWE-312 · Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0355 third-party-advisory