CVE-2024-12094
Medium
Description
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.
SeverityMedium
CVSS5.4
Exploit probability—
ProductTinxy Android app
PublishedDec 5, 2024
First seenDec 5, 2024
Weakness typeCWE-312CWE-312
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mogify Infotech Tinxy Android app | <663000 | — |
| Mogify Infotech Tinxy iOS app | <6.7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.