CVE-2021-27768: hcl software verse for android Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2021-27768 is a medium (CVSS 6.3) Channel Accessible by Non-Endpoint vulnerability in hcl software verse for android. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Timeline

1. 12-05-2022
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.