CVE-2020-35138
First published: Mon Mar 29 2021(Updated: )
** DISPUTED ** The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mobileiron Mobile\@work | <=2021-03-22 | |
| <=2021-03-22 | ||
| Mobileiron Mobile\@work | <=2021-03-22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/optiv/rustyIron
- https://play.google.com/store/apps/details?id=com.mobileiron&hl=en_US&gl=US
- https://www.ivanti.com/blog/a-warranted-response-to-inaccurate-optiv-research
- https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration
- https://www.optiv.com/insights/source-zero/blog/mobileiron-mdm-contains-static-key-allowing-account-enumeration
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-35138.
What is the severity of CVE-2020-35138?
CVE-2020-35138 has a severity level of critical.
What is the affected software for CVE-2020-35138?
The affected software for CVE-2020-35138 is MobileIron Mobile@work for Android and iOS versions up to 2021-03-22.
What is the CWE ID for CVE-2020-35138?
CVE-2020-35138 has a CWE ID of 798.
Are there any known fixes or mitigations for CVE-2020-35138?
There are no known fixes or mitigations available for CVE-2020-35138 at the moment. It is recommended to follow the vendor's advisories for any updates or patches.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/status
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/mobileiron
- canonical/mobileiron mobile\@work
- version/mobileiron mobile\@work/2021-03-22