PT-2021-17478 · Ypsomed · Ypsomed Mylife Cloud+1

Dr. Oliver Matula + 3 · Published 2021-07-30 · Updated 2021-08-10 · CVE-2021-27495

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ypsomed mylife Cloud versions prior to 1.7.2 Ypsomed mylife App versions prior to 1.7.5

Description The Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint.

Recommendations For Ypsomed mylife Cloud versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. For Ypsomed mylife App versions prior to 1.7.5, update to version 1.7.5 or later to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-27495

Affected Products

Ypsomed Mylife App

Ypsomed Mylife Cloud

References · 5

• https://osv.dev/vulnerability/CVE-2021-27495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27495 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsma-21-196-01 · Note
• https://t.me/cibsecurity/26642 · Telegram Post
• https://t.me/cvenotify/18388 · Telegram Post