CVE-2024-27440 (GCVE-0-2024-27440)

Vulnerability from cvelistv5 – Published: 2024-03-13 05:40 – Updated: 2024-08-05 13:41
VLAI
Summary
The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • Improper server certificate verification
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN52919306/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:toyoko_inn:toyoko_inn:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "toyoko_inn",
            "vendor": "toyoko_inn",
            "versions": [
              {
                "lessThan": "1.13.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-13T14:30:43.556851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:41:39.271Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Toyoko Inn official App for iOS",
          "vendor": "Toyoko Inn IT Solution Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 1.13.0"
            }
          ]
        },
        {
          "product": "Toyoko Inn official App for Android",
          "vendor": "Toyoko Inn IT Solution Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "prior 1.3.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don\u0027t properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper server certificate verification",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-13T05:40:22.838Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN52919306/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-27440",
    "datePublished": "2024-03-13T05:40:22.838Z",
    "dateReserved": "2024-02-26T01:49:51.712Z",
    "dateUpdated": "2024-08-05T13:41:39.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27440",
      "date": "2026-07-17",
      "epss": "0.00224",
      "percentile": "0.1298"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27440\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-03-13T06:15:52.273\",\"lastModified\":\"2026-06-17T07:19:54.290\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don\u0027t properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n oficial de Toyoko Inn para versiones de iOS anteriores a 1.13.0 y la aplicaci\u00f3n oficial de Toyoko Inn para versiones de Android anteriores a 1.3.14 no verifican correctamente los certificados del servidor, lo que permite a un atacante intermediario falsificar servidores y obtener datos e informaci\u00f3n confidencial a trav\u00e9s de un certificado elaborado.\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"Toyoko Inn IT Solution Co., Ltd.\",\"product\":\"Toyoko Inn official App for iOS\",\"versions\":[{\"version\":\"prior to 1.13.0\",\"status\":\"affected\"}]},{\"vendor\":\"Toyoko Inn IT Solution Co., Ltd.\",\"product\":\"Toyoko Inn official App for Android\",\"versions\":[{\"version\":\"prior 1.3.14\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"toyoko_inn\",\"product\":\"toyoko_inn\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:toyoko_inn:toyoko_inn:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.13.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-13T14:30:43.556851Z\",\"id\":\"CVE-2024-27440\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"references\":[{\"url\":\"https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN52919306/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://jvn.jp/en/jp/JVN52919306/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:07:32+00:00",
      "cve": "CVE-2024-27440",
      "id": "CVE-2024-27440",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-27440",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27440.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN52919306/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.381Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27440\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-13T14:30:43.556851Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:toyoko_inn:toyoko_inn:*:*:*:*:*:*:*:*\"], \"vendor\": \"toyoko_inn\", \"product\": \"toyoko_inn\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.13.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-05T13:39:32.343Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Toyoko Inn IT Solution Co., Ltd.\", \"product\": \"Toyoko Inn official App for iOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 1.13.0\"}]}, {\"vendor\": \"Toyoko Inn IT Solution Co., Ltd.\", \"product\": \"Toyoko Inn official App for Android\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior 1.3.14\"}]}], \"references\": [{\"url\": \"https://apps.apple.com/jp/app/%E3%83%9B%E3%83%86%E3%83%AB%E6%9D%B1%E6%A8%AAinn-%E6%9D%B1%E6%A8%AA%E3%82%A4%E3%83%B3-%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1439388270\"}, {\"url\": \"https://play.google.com/store/apps/details?id=com.toyoko_inn.toyokoandroid\"}, {\"url\": \"https://jvn.jp/en/jp/JVN52919306/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don\u0027t properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Improper server certificate verification\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-03-13T05:40:22.838Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27440\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-05T13:41:39.271Z\", \"dateReserved\": \"2024-02-26T01:49:51.712Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-03-13T05:40:22.838Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.