critical9.8
CVE-2019-13096
TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage.
Impact
TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/<wallet-name>.xml to gain unauthorized access.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tronlink | Wallet | Version 2.2.0 |