What’s Vulnerable › Vulnerabilities

CVE-2021-21385: Disabled hostname verification and accepting self-signed certificates

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-24 · updated 2026-06-17
• Weakness: CWE-295

Description

Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.

Affected products

• openMF mifos-mobile: before 2021-03-14 — fixed in 2021-03-14

How to fix

Upgrade to a fixed version: openMF mifos-mobile 2021-03-14. Check the vendor advisory for mitigations.

References

• https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d
• https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx
• https://openmf.github.io/mobileapps.github.io/
• https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d
• https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx
• https://openmf.github.io/mobileapps.github.io/

Get alerted when CVE-2021-21385 or the next vulnerability affects your stack