PatchTheCVECVE-2020-35398: An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute for
CVE-2020-35398 is a medium-severity flaw (CVSS 5.3) affecting uti mutual fund invest online. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 33%) |
| CISA exploited list | No |
| Weakness | CWE-203 |
| Published | 2021-12-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-35398?
uti mutual fund invest online: upgrade to newer than 5.4.28. Exact commands for each OS are on this page.
Is CVE-2020-35398 being exploited?
CVE-2020-35398 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-35398 affect?
CVE-2020-35398 affects uti mutual fund invest online. Severity is medium (CVSS 5.3). An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.
How urgent is CVE-2020-35398?
Priority 45/100. Public exploit reference; Remotely exploitable, no login, no user action