PT-2021-5217 · Unknown · Mahavitaran

Published 2021-12-07 · Updated 2021-12-09 · CVE-2020-27413

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mahavitaran android application versions 7.50 and below

Description The issue is related to insufficient protection of registration data in the Mahavitaran android application. This allows local attackers to read cleartext username and password while the user is logged into the application.

Recommendations For Mahavitaran android application versions 7.50 and below, consider updating to a version above 7.50 to resolve the issue. As a temporary workaround, restrict access to sensitive information within the application to minimize the risk of exploitation. Avoid using the application with sensitive data until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2021-06019

CVE-2020-27413

Affected Products

Mahavitaran

References · 10

• http://maharashtra.com · Vendor Advisory
• http://mahavitaran.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27413 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06019 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-27413 · Security Note
• https://cvewalkthrough.com/cve-2020-27413-mahavitaran-android-application-clear-text-password-storage · Note
• https://play.google.com/store/apps/details?id=com.msedcl.app&utm_source=APKdownloadMirror.com · Note
• https://t.me/cvenotify/24420 · Telegram Post
• https://t.me/cibsecurity/33439 · Telegram Post
• https://play.google.com/store/apps/details?id=com.msedcl.app&utm_source=APKdownloadMirror.com · Note