Read the docs
TI-2016-04182 Aliases CVE-2016-4839GHSA-h25f-2g8f-4527

Information disclosure in Money Forward

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application.

Why it matters now

EPSS 0.01661 76th percentileScored 2026-11-07
Fix Fixed Money Forward (Money Foward, Inc.): v7.18.0Money Forward for The Gunma Bank (Money Foward, Inc.): v1.2.0+9 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Money Foward, Inc.Money Forwardbefore v7.18.0v7.18.0Patch availableCNA
Money Foward, Inc.Money Forward for The Gunma Bankbefore v1.2.0v1.2.0Patch availableCNA
Money Foward, Inc.Money Forward for SHIGA BANKbefore v1.2.0v1.2.0Patch availableCNA
Money Foward, Inc.Money Forward for SHIZUOKA BANKbefore v1.4.0v1.4.0Patch availableCNA
Money Foward, Inc.Money Forward for SBI Sumishin Net Bankbefore v1.6.0v1.6.0Patch availableCNA
Money Foward, Inc.Money Forward for Tokai Tokyo Securitiesbefore v1.4.0v1.4.0Patch availableCNA
Money Foward, Inc.Money Forward for THE TOHO BANKbefore v1.3.0v1.3.0Patch availableCNA
Money Foward, Inc.Money Forward for YMFGbefore v1.5.0v1.5.0Patch availableCNA
SOURCENEXT CORPORATIONMoney Forward for AppPassbefore v7.18.3v7.18.3Patch availableCNA
SOURCENEXT CORPORATIONMoney Forward for au SMARTPASSbefore v7.18.0v7.18.0Patch availableCNA
SOURCENEXT CORPORATIONMoney Forward for Chou Houdaibefore v7.18.3v7.18.3Patch availableCNA
  • Money Forward VendorMoney Foward, Inc. Affected before v7.18.0 Fixed in v7.18.0 Patch available CNA
  • Money Forward for The Gunma Bank VendorMoney Foward, Inc. Affected before v1.2.0 Fixed in v1.2.0 Patch available CNA
  • Money Forward for SHIGA BANK VendorMoney Foward, Inc. Affected before v1.2.0 Fixed in v1.2.0 Patch available CNA
  • Money Forward for SHIZUOKA BANK VendorMoney Foward, Inc. Affected before v1.4.0 Fixed in v1.4.0 Patch available CNA
  • Money Forward for SBI Sumishin Net Bank VendorMoney Foward, Inc. Affected before v1.6.0 Fixed in v1.6.0 Patch available CNA
  • Money Forward for Tokai Tokyo Securities VendorMoney Foward, Inc. Affected before v1.4.0 Fixed in v1.4.0 Patch available CNA
  • Money Forward for THE TOHO BANK VendorMoney Foward, Inc. Affected before v1.3.0 Fixed in v1.3.0 Patch available CNA
  • Money Forward for YMFG VendorMoney Foward, Inc. Affected before v1.5.0 Fixed in v1.5.0 Patch available CNA
  • Money Forward for AppPass VendorSOURCENEXT CORPORATION Affected before v7.18.3 Fixed in v7.18.3 Patch available CNA
  • Money Forward for au SMARTPASS VendorSOURCENEXT CORPORATION Affected before v7.18.0 Fixed in v7.18.0 Patch available CNA
  • Money Forward for Chou Houdai VendorSOURCENEXT CORPORATION Affected before v7.18.3 Fixed in v7.18.3 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:moneyforward:money_forward_for_apppass:*:*:*:*:*:android:*:*before 7.18.3VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_au_smartpass:*:*:*:*:*:android:*:*before 7.18.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_chou_houdai:*:*:*:*:*:android:*:*before 7.18.3VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_sbi_sumishin_net_bank:*:*:*:*:*:android:*:*before 1.6.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_shiga_bank:*:*:*:*:*:android:*:*before 1.2.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_shizuoka_bank:*:*:*:*:*:android:*:*before 1.4.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_the_gunma_bank:*:*:*:*:*:android:*:*before 1.2.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_the_toho_bank:*:*:*:*:*:android:*:*before 1.3.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_tokai_tokyo_securities:*:*:*:*:*:android:*:*before 1.4.0VulnerableMoneyforward
cpe:2.3:a:moneyforward:money_forward_for_ymfg:*:*:*:*:*:android:*:*before 1.5.0VulnerableMoneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_apppass:*:*:*:*:*:android:*:* Versions before 7.18.3 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_au_smartpass:*:*:*:*:*:android:*:* Versions before 7.18.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_chou_houdai:*:*:*:*:*:android:*:* Versions before 7.18.3 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_sbi_sumishin_net_bank:*:*:*:*:*:android:*:* Versions before 1.6.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_shiga_bank:*:*:*:*:*:android:*:* Versions before 1.2.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_shizuoka_bank:*:*:*:*:*:android:*:* Versions before 1.4.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_the_gunma_bank:*:*:*:*:*:android:*:* Versions before 1.2.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_the_toho_bank:*:*:*:*:*:android:*:* Versions before 1.3.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_tokai_tokyo_securities:*:*:*:*:*:android:*:* Versions before 1.4.0 Vulnerable ·Moneyforward
  • cpe:2.3:a:moneyforward:money_forward_for_ymfg:*:*:*:*:*:android:*:* Versions before 1.5.0 Vulnerable ·Moneyforward

Remediation

  • Fix · CNA Money Forward (Money Foward, Inc.) Fixed in v7.18.0
  • Fix · CNA Money Forward for The Gunma Bank (Money Foward, Inc.) Fixed in v1.2.0
  • Fix · CNA Money Forward for SHIGA BANK (Money Foward, Inc.) Fixed in v1.2.0
  • Fix · CNA Money Forward for SHIZUOKA BANK (Money Foward, Inc.) Fixed in v1.4.0
  • Fix · CNA Money Forward for SBI Sumishin Net Bank (Money Foward, Inc.) Fixed in v1.6.0
  • Fix · CNA Money Forward for Tokai Tokyo Securities (Money Foward, Inc.) Fixed in v1.4.0
  • Fix · CNA Money Forward for THE TOHO BANK (Money Foward, Inc.) Fixed in v1.3.0
  • Fix · CNA Money Forward for YMFG (Money Foward, Inc.) Fixed in v1.5.0
  • Fix · CNA Money Forward for AppPass (SOURCENEXT CORPORATION) Fixed in v7.18.3
  • Fix · CNA Money Forward for au SMARTPASS (SOURCENEXT CORPORATION) Fixed in v7.18.0
  • Fix · CNA Money Forward for Chou Houdai (SOURCENEXT CORPORATION) Fixed in v7.18.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-4839
  2. 2026-10-03 Alias added: GHSA-h25f-2g8f-4527

References

Advisory 3

  • TI-2008-04224 Unspecified vulnerability in SOURCENEXT Virus Security ZERO 9.5.0173 and earlier and… CVSS 2.0HIGH 10.0
  • TI-2016-04181 Improper input validation in Money Forward CVSS 3.1HIGH 7.8
  • TI-2017-01540 Untrusted search path in SOURCENEXT CORPORATION Self-extracting archive files created by… CVSS 3.0HIGH 7.8
  • TI-2007-01552 Cross-site scripting (XSS) vulnerability in the RSS reader in a certain SOURCENEXT… CVSS 2.0MEDIUM 4.3
  • TI-2023-20480 Improper handling of exceptional conditions in FFRI yarai CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences