PT-2021-23824 · Unisys · Unisys Cargo Mobile Application

Published 2021-12-14 · Updated 2021-12-16 · CVE-2021-43388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unisys Cargo Mobile Application versions prior to 1.2.29

Description The issue concerns the storage of sensitive information in cleartext, which could be exposed through a backup. This is addressed by setting the allowBackup flag in the manifest to False.

Recommendations For versions prior to 1.2.29, ensure the allowBackup flag in the manifest is set to False to prevent sensitive information from being stored in cleartext and potentially revealed in a backup.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-43388

Affected Products

Unisys Cargo Mobile Application

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-43388 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43388 · Vendor Advisory
• https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=65 · Vendor Advisory
• https://t.me/cibsecurity/33956 · Telegram Post