CVE-2021-3179 : GGLocker iOS application, contains an insecure data storage of the password hash

GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass.

Published 2021-12-16 20:15:08

Updated 2021-12-22 15:05:59

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2021-3179

Gglocker Project » Gglocker » Version: N/A For Iphone Os
cpe:2.3:a:gglocker_project:gglocker:-:*:*:*:*:iphone_os:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 15 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Assigned by: nvd@nist.gov (Primary)

https://apps.apple.com/us/app/gglocker/id1449241376#?platform=iphone

GGLocker on the App Store
Product;Third Party Advisory
https://github.com/ggreco/gglocker/blob/master/gglocker/LoginCheck.m

gglocker/LoginCheck.m at master · ggreco/gglocker · GitHub
Third Party Advisory
https://medium.com/@ksteo11/yet-another-password-manager-app-how-to-better-secure-it-8e9df2ce35c8

Yet another password manager app, how to better secure it? | by Kok Sang Teo | Medium
Exploit;Third Party Advisory

Jump to