CVE-2020-35398
Last modified
CVE-2020-35398 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.. EPSS estimates a 1.12% chance of exploitation in the next 30 days.
Description
An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Utimf | Uti Mutual Fund Invest Online | <= 5.4.28 |
References
- https://cvewalkthrough.com/cve-2020-35398-uti-mutual-fund-android-application-username-enumeration/Exploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.utimutualfunds.utimutualfund&hl=en_IN&gl=USProduct, Third Party Advisory
- https://cvewalkthrough.com/cve-2020-35398-uti-mutual-fund-android-application-username-enumeration/Exploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.utimutualfunds.utimutualfund&hl=en_IN&gl=USProduct, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-35398?
How severe is CVE-2020-35398?
How do I fix CVE-2020-35398?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-35382SQL Injection in Classbooking before 2.4.1 via the username …7.2
- CVE-2020-35388rainrocka xinhu 2.1.9 allows remote attackers to obtain sens…7.5
- CVE-2020-3539A vulnerability in the web-based management interface of Cis…6.3
- CVE-2020-35391Tenda N300 F3 12.01.01.48 devices allow remote attackers to …6.5
- CVE-2020-35395XSS in the Add Expense Component of EGavilan Media Expense M…6.1
- CVE-2020-35396EGavilan Barcodes generator 1.0 is affected by: Cross Site S…6.1
- CVE-2020-3541A vulnerability in the media engine component of Cisco Webex…4.4
- CVE-2020-35416Multiple cross-site scripting (XSS) vulnerabilities exist in…6.1
- CVE-2020-35418Cross Site Scripting (XSS) in the contact page of Group Offi…5.4
- CVE-2020-35419Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via t…6.1
- CVE-2020-3542A vulnerability in Cisco Webex Training could allow an authe…5.3
- CVE-2020-35427SQL injection vulnerability in PHPGurukul Employee Record Ma…9.8
Are you affected by CVE-2020-35398?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST