The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
oryginał ENCVSS Vector
AV:A/AC:M/Au:N/C:P/I:P/A:PMobileiron Mobile\@work
APPMobileiron6.0.0.1.12r
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2020-35138CRITICAL9.8PL ✓ten sam produkt
MobileIron Mobile@Work — zakodowany klucz szyfrowania poświadczeń
CVE-2020-35137HIGH7.5ten sam produkt
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate ...
CVE-2021-3391MEDIUM5.3ten sam produkt
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexiste...
CVE-2020-15505CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Zdalne wykonanie kodu (RCE) w MobileIron Core, Sentry i RDB
CVE-2020-15506CRITICAL9.8PL ✓ten sam vendor
Authentication bypass w MobileIron Core & Connector — pominięcie uwierzytelnienia