PT-2021-14203 · Unknown · Retty App For Ios+1

Ryo Sato · Published 2021-07-14 · Updated 2021-07-16 · CVE-2021-20748

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Retty App for Android versions prior to 4.8.13 Retty App for iOS versions prior to 4.11.14

Description: The issue concerns the use of a hard-coded API key for an external service in the Retty App. This could allow the API key to be obtained by analyzing data in the app, potentially leading to its exploitation.

Recommendations: For Retty App for Android versions prior to 4.8.13, update to version 4.8.13 or later. For Retty App for iOS versions prior to 4.11.14, update to version 4.11.14 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-20748

Affected Products

Retty App For Android

Retty App For Ios

References · 6

• https://osv.dev/vulnerability/CVE-2021-20748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20748 · Security Note
• https://t.me/cvenotify/17755 · Telegram Post
• https://jvn.jp/en/jp/JVN26891339/index.html · Note
• https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view · Note
• https://t.me/cvenotify/17555 · Telegram Post