CVE-2019-8350

low-risk
Published 2019-05-13

The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked the user's password to the keyboard autocomplete functionality. Third-party Android keyboards that capture the password may store this password in cleartext, or transmit the password to third-party services for keyboard customization purposes. A compromise of any datastore that contains keyboard autocompletion caches would result in the disclosure of the user's Simple Bank password.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.6/10 Medium
PHYSICAL / LOW complexity

Affected Products (1)

Better Banking

Affected Vendors

Simple

References (4)

Third Party Advisory https://www.bishopfox.com/news/2019/02/simple-better-banking-android-v-2-45-0-2-...
Vendor Advisory https://www.simple.com/policies/security
Third Party Advisory https://www.bishopfox.com/news/2019/02/simple-better-banking-android-v-2-45-0-2-...
Vendor Advisory https://www.simple.com/policies/security
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal