TI-2022-00074 Aliases CVE-2022-0131 GHSA-r9rx-885h-88c4

Hard-coded credentials in Jimoty, Inc. Jimoty App for Android

LOW 15CWE-798Published 2022-01-17 · Updated 2024-08-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.

Why it matters now

EPSS 0.00203 10th percentileScored 2026-11-07

Fix Fixed Jimoty App for Android (Jimoty, Inc.): 3.7.42

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jimoty, Inc.	Jimoty App for Android	before 3.7.42	3.7.42	Patch available	CNA

Jimoty App for Android VendorJimoty, Inc. Affected before 3.7.42 Fixed in 3.7.42 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jmty:jimoty::::::android::*	before 3.7.42	Vulnerable	Jmty

cpe:2.3:a:jmty:jimoty:*:*:*:*:*:android:*:* Versions before 3.7.42 Vulnerable ·Jmty

Remediation

Fix · CNA Jimoty App for Android (Jimoty, Inc.) Fixed in 3.7.42

Timeline

2026-10-02 Threatist record created from CVE-2022-0131
2026-10-03 Alias added: GHSA-r9rx-885h-88c4

References

Advisory 1

https://jvn.jp/en/jp/JVN49047921/index.html

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences