CVE-2021-21385

HIGH 7.4CVE-2021-21385 · Published 24/03/2021 · updated 17/06/2026

In short

CVE-2021-21385 is a HIGH (CVSS 7.4) vulnerability affecting mifos-mobile (mifos).
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 55.0% of all vulnerabilities.
Fix: update to 2021-03-14 or later.

Package	Affected versions	Patched versions
mifos-mobile mifos	`< 2021-03-14`	`2021-03-14`

Description

Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.

References

openMF/mifos-mobile commit e505f62 · Patch
openMF/mifos-mobile security advisory · Patch
openmf.github.io/mobileapps.github.io · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free