CVE-2019-13098 - CVE House
Back to Database
Status published Medium CVE-2019-13098

The user password via the registration form of TronLink Wallet...

Vulnerability Description

The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13098

Credits & Attribution

No credits recorded in the NVD database.

References

More from tronlink

View All →
CVE-2019-13096
TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and...
Critical 9.8

Affected Vendor

Affected Software

wallet
Vulnerable Versions:
2.2.0

Timeline

Official Publish: July 22nd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.