CVE-2020-35398

Name of the Vulnerable Software and Affected Versions: UTI Mutual fund Android application versions 5.4.18 and prior

Description: An issue in the UTI Mutual fund Android application allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.

Recommendations: For versions 5.4.18 and prior, consider implementing rate limiting or IP blocking to prevent brute force attacks, and modify the error message to not disclose whether the username is valid or not. At the moment, there is no information about a newer version that contains a fix for this vulnerability.