The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Vector
AV:A/AC:M/Au:N/C:P/I:P/A:PMobileiron Mobile\@work
APPMobileiron6.0.0.1.12r
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2020-35138CRITICAL9.8PL ✓same product
MobileIron Mobile@Work — zakodowany klucz szyfrowania poświadczeń
CVE-2020-35137HIGH7.5same product
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate ...
CVE-2021-3391MEDIUM5.3same product
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexiste...
CVE-2020-15505CRITICAL9.8⚠ KEVPL ✓same vendor
Zdalne wykonanie kodu (RCE) w MobileIron Core, Sentry i RDB
CVE-2020-15506CRITICAL9.8PL ✓same vendor
Authentication bypass w MobileIron Core & Connector — pominięcie uwierzytelnienia