PT-2021-22922 · Unknown · Com.Onepeloton.Erlich

Sam Quinn · Published 2021-10-25 · Updated 2021-10-29 · CVE-2021-40527

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions com.onepeloton.erlich versions up to and including 1.7.22

Description Exposure of sensitive information to an unauthorized actor in the mobile application allows a remote attacker to access developer files stored in an AWS S3 bucket by reading credentials stored in plain text within the application.

Recommendations For versions up to and including 1.7.22, update to a version that fixes the exposure of sensitive information to prevent unauthorized access to developer files stored in the AWS S3 bucket. As a temporary workaround, consider restricting access to the AWS S3 bucket until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-40527

Affected Products

Com.Onepeloton.Erlich

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-40527 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40527 · Vendor Advisory
• https://t.me/cibsecurity/31109 · Telegram Post
• https://twitter.com/ROPsicle/status/1438216078103044107?s=20 · Note
• https://t.me/cvenotify/22318 · Telegram Post
• https://t.me/cvenotify/22618 · Telegram Post