VULNERABILITY INTELLIGENCE

CVE-2018-15661

CVSS score7.5 HIGH
EPSS probability1.23%
CISA KEVNot currently listed
Published2018-08-21
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references