CVE-2021-27495 Information disclosure in Ypsomed mylife Cloud, mylife Mobile Application
The Ypsomed mylife mobile application and cloud service expose user passwords by reflecting them during a redirect from HTTPS to HTTP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-27495?
CVE-2021-27495 is a high-severity vulnerability in Ypsomed mylife Cloud, mylife Mobile Application, published on 30 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint.
Weakness: CWE-522
Which versions are affected by CVE-2021-27495?
It affects 2 products.
Products include Ypsomed Mylife, Ypsomed Mylife Cloud.
How do I fix CVE-2021-27495?
No fix has been published for CVE-2021-27495 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27495 being exploited?
There is no known exploitation of CVE-2021-27495 in the wild and no public exploit code.
Other vulnerabilities in Ypsomed mylife Cloud, mylife Mobile Application
Sources
Also known as GHSA-23gr-x4f6-vrp6.