OpenCVE

An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/aaravavi/TVS-Connect-Application-VAPT
https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main
https://github.com/msn-official/CVE-Evidence

History

Tue, 06 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-30T00:00:00

Updated: 2024-08-06T19:38:08.497Z

Reserved: 2024-04-23T00:00:00

Link: CVE-2024-33309

Vulnrichment

Updated: 2024-08-02T02:27:53.621Z

NVD

Status : Awaiting Analysis

Published: 2024-04-30T15:15:53.293

Modified: 2024-11-21T09:16:47.607

Link: CVE-2024-33309

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-33309", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-06T19:38:08.497Z", "dateReserved": "2024-04-23T00:00:00", "datePublished": "2024-04-30T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-05T16:05:23.390839"}, "descriptions": [{"lang": "en", "value": "An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository."}], "tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main"}, {"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT"}, {"url": "https://github.com/msn-official/CVE-Evidence"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.621Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main", "tags": ["x_transferred"]}, {"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT", "tags": ["x_transferred"]}, {"url": "https://github.com/msn-official/CVE-Evidence", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "affected": [{"vendor": "tvs_motor_company", "product": "connect", "cpes": ["cpe:2.3:a:tvs_motor_company:connect:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.5.1", "status": "affected"}]}, {"vendor": "tvs_motor_company", "product": "ios", "cpes": ["cpe:2.3:a:tvs_motor_company:ios:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.0.0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-08T17:51:59.418755Z", "id": "CVE-2024-33309", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T19:38:08.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main", "tags": ["x_transferred"]}, {"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT", "tags": ["x_transferred"]}, {"url": "https://github.com/msn-official/CVE-Evidence", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.621Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-33309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-08T17:51:59.418755Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tvs_motor_company:connect:*:*:*:*:*:*:*:*"], "vendor": "tvs_motor_company", "product": "connect", "versions": [{"status": "affected", "version": "4.5.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:tvs_motor_company:ios:*:*:*:*:*:*:*:*"], "vendor": "tvs_motor_company", "product": "ios", "versions": [{"status": "affected", "version": "5.0.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-08T17:36:27.966Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT/tree/main"}, {"url": "https://github.com/aaravavi/TVS-Connect-Application-VAPT"}, {"url": "https://github.com/msn-official/CVE-Evidence"}], "descriptions": [{"lang": "en", "value": "An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-05T16:05:23.390839"}}}, "cveMetadata": {"cveId": "CVE-2024-33309", "state": "PUBLISHED", "dateUpdated": "2024-08-06T19:38:08.497Z", "dateReserved": "2024-04-23T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-30T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}