VulnerabilityDeferred

CVE-2024-53683

An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use.

MEDIUM 5.6EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use.

CVSS 4.0: 5.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-497
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.