cve/2018/CVE-2018-18976.md

CVE-2018-18976

Description

An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)

POC

Reference

• https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic
• https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic

Github

No PoCs found on GitHub currently.