CVE-2021-20748 Hardcoded credentials in Retty App
Attackers can extract hard-coded API keys from the Retty mobile app to access external services, requiring users to update to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20748?
CVE-2021-20748 is a high-severity vulnerability in Retty App, published on 14 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
Weakness: CWE-798
Which versions are affected by CVE-2021-20748?
It affects 1 product.
Products include Retty Retty.
How do I fix CVE-2021-20748?
No fix has been published for CVE-2021-20748 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20748 being exploited?
There is no known exploitation of CVE-2021-20748 in the wild and no public exploit code.
Other vulnerabilities in Retty App
Sources
Also known as GHSA-46ph-ff6f-rhhq.