Main Vulnerability Database Vulnerabilities #VU54860

Use of hard-coded credentials in Retty App for Android and Retty App for iOS - CVE-2021-20748

Published: July 14, 2021

Vulnerability identifier: #VU54860

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20748

CWE-ID: CWE-798

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A local attacker can analyze the data in the App and obtain the API key for external services.

Affected software

Retty App for Android
Retty App for iOS

How to mitigate CVE-2021-20748

Install updates from vendor's website.

Retty App for Android - update to 4.8.13
Retty App for iOS - update to 4.11.14

External References

Related Security Bulletins