CVE-2017-14487
CriticalSummary
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in the OMB.xml file.
Risk Assessment
Attackers can gain access to user accounts, potentially leading to personal data leaks and violations of user privacy.
Recommendation
It is recommended to implement encryption for communication and user identity verification to minimize the risk of impersonation.
Original NVD description (English source)
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.