CVE-2018-17402 - CVE House
Back to Database
Status published Medium CVE-2018-17402

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for...

Vulnerability Description

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app, that the Android platform provides fair warnings to the users before turning on accessibility for any application, and that it believes it is similar to installing malicious keyboards, or malicious apps taking screenshots

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-17402

Credits & Attribution

No credits recorded in the NVD database.

References

More from phonepe

View All →
CVE-2018-17403
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for...
High 8.8
CVE-2018-17401
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for...
High 8.8
CVE-2018-17400
The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for...
High 7

Affected Vendor

Affected Software

phonepe
Vulnerable Versions:
3.0.6

Timeline

Official Publish: September 23rd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.