actuator/com.phlox.simpleserver

actuator/com.phlox.simpleserver

Releases0

Stars1

CVE-2023-46918 | CVE-2023-46919

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-46918 ↗	Dec 27, 2023Wednesday, 27 December 2023, 22:15	4.6 MEDIUM	—
Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.
CVE-2023-46919 ↗	Dec 27, 2023Wednesday, 27 December 2023, 21:15	6.3 MEDIUM	—
Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application's source code or binary can extract this key & use it decrypt the TLS secret.