CVE-2025-56608

Katalog CVE

CVSS 4.2 · Medium EPSS 0,32%

Kerentanan Authentication Bypass by Spoofing pada donbermoy android corona virus tracker app for india. Skor CVSS 3.1 4.2 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.

Rincian

Terbit di NVD

3 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md advisory pihak ketiga
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-an... deskripsi teknis
• https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html product