CVE-2021-40527

Name of the Vulnerable Software and Affected Versions com.onepeloton.erlich versions up to and including 1.7.22

Description Exposure of sensitive information to an unauthorized actor in the mobile application allows a remote attacker to access developer files stored in an AWS S3 bucket by reading credentials stored in plain text within the application.

Recommendations For versions up to and including 1.7.22, update to a version that fixes the exposure of sensitive information to prevent unauthorized access to developer files stored in the AWS S3 bucket. As a temporary workaround, consider restricting access to the AWS S3 bucket until a patch is available.