CVE-2021-21385: Mifos Mifos-Mobile

High severity, CVSS 7.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.

Affected products

• Mifos Mifos-Mobile: before 2021-03-14 (fixed in 2021-03-14)

Published 2021-03-24. Last modified 2026-06-17.