CVE-2024-27440

Published: Mar 13, 2024Modified: Jun 17, 2026Deferred

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (6)

https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270

Source: vultures@jpcert.or.jp

https://jvn.jp/en/jp/JVN52919306/

Source: vultures@jpcert.or.jp

https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid

Source: vultures@jpcert.or.jp

https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270

Source: af854a3a-2127-422b-91ae-364da2661108

https://jvn.jp/en/jp/JVN52919306/

Source: af854a3a-2127-422b-91ae-364da2661108

https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.