What’s Vulnerable › Vulnerabilities

CVE-2020-35398

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-23 · updated 2026-06-17
• Weakness: CWE-203

Description

An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.

Affected products

• Utimf Uti Mutual Fund Invest Online: through 5.4.28

References

• https://cvewalkthrough.com/cve-2020-35398-uti-mutual-fund-android-application-username-enumeration/
• https://play.google.com/store/apps/details?id=com.utimutualfunds.utimutualfund&hl=en_IN&gl=US
• https://cvewalkthrough.com/cve-2020-35398-uti-mutual-fund-android-application-username-enumeration/
• https://play.google.com/store/apps/details?id=com.utimutualfunds.utimutualfund&hl=en_IN&gl=US

Get alerted when CVE-2020-35398 or the next vulnerability affects your stack