CVE-2016-4838

HIGH

7.8

CVSS Score

Published: May 12, 2017 at 06:00 PM UTC

Updated: June 17, 2026 at 12:48 AM UTC

21 products affected across 3 vendorsMoney Forward for ApppassMoney Forward for Shiga BankMoney Forward for the Toho Bank

Using Money Forward by Money Foward, Inc.?

Get instant alerts when new vulnerabilities affect Money Forward - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 1%

Description

The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION allows an attacker to execute unintended operations via a specially crafted application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Money Forward for Apppass · Moneyforward

95%

v < 7.18.3

Affected range stops below 7.18.3, so it looks safe — our inference, not a vendor statement

Money Forward for Au Smartpass · Moneyforward

95%

v < 7.18.0

Affected range stops below 7.18.0, so it looks safe — our inference, not a vendor statement

Money Forward for Chou Houdai · Moneyforward

95%

v < 7.18.3

Affected range stops below 7.18.3, so it looks safe — our inference, not a vendor statement

Money Forward for Sbi Sumishin .NET Bank · Moneyforward

95%

v < 1.6.0

Affected range stops below 1.6.0, so it looks safe — our inference, not a vendor statement

Money Forward for Shiga Bank · Moneyforward

95%

v < 1.2.0

Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement

Money Forward for Shizuoka Bank · Moneyforward

95%

v < 1.4.0

Affected range stops below 1.4.0, so it looks safe — our inference, not a vendor statement

Money Forward for the Gunma Bank · Moneyforward

95%

v < 1.2.0

Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement

Money Forward for the Toho Bank · Moneyforward

95%

v < 1.3.0

Affected range stops below 1.3.0, so it looks safe — our inference, not a vendor statement

Money Forward for Tokai Tokyo Securities · Moneyforward

95%

v < 1.4.0

Affected range stops below 1.4.0, so it looks safe — our inference, not a vendor statement

Money Forward for Ymfg · Moneyforward

95%

v < 1.5.0

Affected range stops below 1.5.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_CONFIRMThird Party AdvisoryVDB Entry

Source: [email protected]

http://corp.moneyforward.com/info/20160920-mf-android/

VDB Entryx_refsource_BIDThird Party Advisory

Source: [email protected]

http://www.securityfocus.com/bid/93034

x_refsource_MISCThird Party AdvisoryVDB Entry

Source: [email protected]

http://www.sourcenext.com/support/i/160725_1

Third Party Advisoryx_refsource_JVNVDB Entry

Source: [email protected]

https://jvn.jp/en/jp/JVN49343562/index.html

CVSS

7.8HIGH[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card