CVE-2020-35137 Hardcoded credentials in n/a
Hardcoded API key in MobileIron agents allows unauthorized access to SaaS discovery API, though the feature is opt-in and not enabled by default.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35137?
CVE-2020-35137 is a high-severity vulnerability in n/a, published on 29 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/RegisterActivity.java and can be used for api/v1/gateway/customers/servers requests. NOTE: Vendor states that this is an opt-in feature to the product - it is not enabled by default and customers cannot enable it without an explicit email to support. At this time, they do not plan change to make any changes to this feature.
Weakness: CWE-798
Which versions are affected by CVE-2020-35137?
It affects 1 product.
Products include Mobileiron Mobile\@work.
How do I fix CVE-2020-35137?
No fix has been published for CVE-2020-35137 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-35137 being exploited?
There is no known exploitation of CVE-2020-35137 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wrvw-xh7r-3r2g.