CVE-2017-15999
CriticalSummary
In the 'NQ Contacts Backup & Restore' application version 1.1 for Android, HTTPS is not used for transmitting login and synced user data. The username is transmitted in cleartext along with an SHA-1 hash of the password.
Risk Assessment
An attacker can intercept login data, leading to the possibility of cracking the password hash or using it for further attacks. This poses a serious threat to user data security.
Recommendation
It is recommended to implement HTTPS in the application to secure the transmission of login and synced user data. Consider using stronger hashing algorithms for passwords as well.
Original NVD description (English source)
In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.