VULNERABILITY INTELLIGENCE

CVE-2017-14487

CVSS score9.1 CRITICAL
EPSS probability1.16%
CISA KEVNot currently listed
Published2017-12-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.

Weakness classification

  • CWE-290: Authentication Bypass by Spoofing

Primary references