{"containers": {"cna": {"affected": [{"product": "Hickory Smart", "vendor": "Belwith Products, LLC", "versions": [{"lessThanOrEqual": "01.01.43", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."}], "datePublic": "2019-08-01T00:00:00", "descriptions": [{"lang": "en", "value": "An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532: Inclusion of Sensitive Information in Log Files", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-08-22T13:51:37", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/"}, {"tags": ["x_refsource_MISC"], "url": "https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US"}], "source": {"advisory": "R7-2019-18.3", "discovery": "INTERNAL"}, "title": "Hickory Smart Lock Insecure Logging on Android", "x_generator": {"engine": "Vulnogram 0.0.7"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "DATE_PUBLIC": "2019-08-01T13:05:00.000Z", "ID": "CVE-2019-5634", "STATE": "PUBLIC", "TITLE": "Hickory Smart Lock Insecure Logging on Android"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Hickory Smart", "version": {"version_data": [{"version_affected": "<=", "version_value": "01.01.43"}]}}]}, "vendor_name": "Belwith Products, LLC"}]}}, "credit": [{"lang": "eng", "value": "This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions."}]}, "generator": {"engine": "Vulnogram 0.0.7"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532: Inclusion of Sensitive Information in Log Files"}]}]}, "references": {"reference_data": [{"name": "https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/", "refsource": "MISC", "url": "https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/"}, {"name": "https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US", "refsource": "MISC", "url": "https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US"}]}, "source": {"advisory": "R7-2019-18.3", "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:01:51.976Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US"}]}]}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2019-5634", "datePublished": "2019-08-22T13:51:37.034660Z", "dateReserved": "2019-01-07T00:00:00", "dateUpdated": "2024-09-17T01:11:56.007Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:belwith-keeler:hickory_smart:*:*:*:*:*:android:*:*", "matchCriteriaId": "3F53ECA1-EEE6-4C7C-96E6-E21395C0B55E", "versionEndIncluding": "01.01.43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de almacenamiento no seguro de informaci\u00f3n confidencial est\u00e1 presente en Hickory Smart para dispositivos m\u00f3viles Android de Belwith Products, LLC. Las comunicaciones para los servicios de la API de Internet y las conexiones directas al candado por medio de Bluetooth Low Energy (BLE) desde la aplicaci\u00f3n m\u00f3vil se logearon en un registro de depuraci\u00f3n en el dispositivo Android en el archivo HickorySmartLog/Logs/SRDeviceLog.txt. Esta informaci\u00f3n se encontr\u00f3 almacenada en las rutas de almacenamiento USB o SDcard predeterminadas del dispositivo Android y es accesible sin rootear el dispositivo. Este problema afecta a Hickory Smart para Android, versi\u00f3n 01.01.43 y versiones anteriores."}], "id": "CVE-2019-5634", "lastModified": "2019-10-09T23:51:01.417", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.0, "impactScore": 4.0, "source": "cve@rapid7.com", "type": "Secondary"}]}, "published": "2019-08-22T14:15:13.617", "references": [{"source": "cve@rapid7.com", "tags": ["Third Party Advisory"], "url": "https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/"}, {"source": "cve@rapid7.com", "tags": ["Product"], "url": "https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}