{"id":"CVE-2018-18976","aliases":["EUVD-2018-10680","GHSA-qqmm-m936-j5v9"],"status":"published","title":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before...","description":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01142,"percentile":0.66863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2019-05-06T19:12:22Z","modified":"2026-06-17T01:48:12Z","products":[{"vendor":"ascensia","product":"contour_diabetes"}],"references":[{"url":"https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18976"},{"url":"https://github.com/advisories/GHSA-qqmm-m936-j5v9"}],"sources":{"cve":[{"id":"CVE-2018-18976","description":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)","status":"published","published":"2019-05-06T19:12:22Z","modified":"2024-08-05T11:23:08.568Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-10680","description":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)","status":"published","published":"2019-05-06T19:12:22Z","modified":"2024-08-05T11:23:08Z","updated_at":"2026-11-03T02:39:34.768254Z"}],"ghsa":[{"id":"GHSA-qqmm-m936-j5v9","title":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before...","description":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)","status":"published","published":"2022-05-24T16:45:12Z","modified":"2024-04-04T00:28:43Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:55:50.017793Z"}],"nvd":[{"id":"CVE-2018-18976","description":"An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)","status":"published","published":"2019-05-06T20:29:00.367Z","modified":"2026-06-17T01:48:12.24Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:04:57.307075Z"}]}}