CVE-2020-35138: Critical severity mobileiron mobile@work vulnerability
DISPUTED The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attack.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-35138.
What is the severity of CVE-2020-35138?
CVE-2020-35138 has a severity level of critical.
What is the affected software for CVE-2020-35138?
The affected software for CVE-2020-35138 is MobileIron Mobile@work for Android and iOS versions up to 2021-03-22.
What is the CWE ID for CVE-2020-35138?
CVE-2020-35138 has a CWE ID of 798.
Are there any known fixes or mitigations for CVE-2020-35138?
There are no known fixes or mitigations available for CVE-2020-35138 at the moment. It is recommended to follow the vendor's advisories for any updates or patches.