NVD Vulnerability Detail

CVE-2021-21385

Summary	Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.
Publication Date	March 25, 2021, 6:15 a.m.
Registration Date	March 25, 2021, 10:02 a.m.
Last Update	Nov. 21, 2024, 2:48 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mifos:mifos-mobile::::::android::*					2021-03-14

Related information, measures and tools

No	URL	タグ
1	https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d	Patch Third Party Advisory
2	https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d	Patch Third Party Advisory
3	https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx	Patch Third Party Advisory
4	https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx	Patch Third Party Advisory
5	https://openmf.github.io/mobileapps.github.io/	Product Third Party Advisory
6	https://openmf.github.io/mobileapps.github.io/	Product Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Android 用 Mifos-Mobile アプリケーションにおける証明書検証に関する脆弱性

Title	Android 用 Mifos-Mobile アプリケーションにおける証明書検証に関する脆弱性
Summary	Android 用 Mifos-Mobile アプリケーションには、証明書検証に関する脆弱性、およびホストの不一致による証明書の検証に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 15, 2021, midnight
Registration Date	Dec. 1, 2021, 6:06 p.m.
Last Update	Dec. 1, 2021, 6:06 p.m.

Affected System

Mifos Initiative

Mifos-Mobile e505f62 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21385	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21385
National Vulnerability Database (NVD)
2	CVE-2021-21385	https://nvd.nist.gov/vuln/detail/CVE-2021-21385

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html
2	CWE-297	https://cwe.mitre.org/data/definitions/297.html

ベンダー情報

No	Name	URL
GitHub
1	Disabled hostname verification and accepting self-signed certificates	https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx
2	Merge pull request from GHSA-9657-33wf-rmvx	https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d
3	Mifos Mobile Apps	https://openmf.github.io/mobileapps.github.io/

Change Log

No	Changed Details	Date of change
1	[2021年12月01日] 掲載	Dec. 1, 2021, 6:06 p.m.