| शीर्षक | Airtel (Bharti Airtel Limited) Airtel Thanks App 4.105.4 Insecure Local Storage (OWASP Mobile Top 10: M2, M5) |
|---|
| विवरण | The Airtel Android app stores sensitive user data such as payment history, personally identifiable information (PII), and authentication-related tokens in unencrypted local storage. These files are accessible in plaintext format at `/Android/data/com.myairtelapp/files/`, violating OWASP Mobile Top 10 standards. This makes the data easily extractable via physical access, ADB, or malicious apps with basic storage permissions.
The issue exposes:
- Payment transaction logs
- Linked mobile numbers
- User personal info
- Login or auth-related metadata
Impact: A malicious actor with device access or minimal permissions can extract and misuse sensitive Airtel user data.
|
|---|
| स्रोत | ⚠️ https://github.com/honestcorrupt/-CVE-Proof-of-Concept-Airtel-Android-App-Insecure-Local-Storage-of-Sensitive-Data |
|---|
| उपयोगकर्ता | honest_corrupt (UID 85229) |
|---|
| सबमिशन | 17/06/2025 07:02 AM (1 वर्ष पहले) |
|---|
| संयम | 26/06/2025 10:02 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 314046 [Bharti Airtel Thanks App 4.105.4 पर Android files सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|