PT-2021-11393 · Unknown · Mahavitaran

Published 2021-12-08 · Updated 2021-12-13 · CVE-2020-27416

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mahavitaran android application versions 7.50 and prior

Description: The issue is related to account takeover due to improper OTP validation, allowing remote attackers to control a user's account.

Recommendations: For Mahavitaran android application versions 7.50 and prior, update to a version that properly validates OTP to prevent account takeover.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-27416

Affected Products

Mahavitaran

References · 5

• https://osv.dev/vulnerability/CVE-2020-27416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27416 · Security Note
• https://cvewalkthrough.com/cve-2021-41716-mahavitaran-android-application-account-take-over-via-otp-fixation · Note
• https://play.google.com/store/apps/details?id=com.msedcl.app&hl=en&gl=US · Note
• https://t.me/cibsecurity/33636 · Telegram Post