PI99445: SECURITY SCAN OF MOBILEFIRST DETECTED A USE OF HARD-CODED PASSWORD

APAR status

• Closed as program error.

Error description

• Product components impacted: MobileFirst Android and Cordova
  JSONStore SDKs
  Mobile Devices Operating Systems impacted: Android
  User roles impacted: Developer
  Distribution: Fix Central
  Versions affected: 8.0
  There is a vulnerability in MFP v8.0 in regards to use of
  Hard-coded Password in MobileFirst code:
  password = "a23456790112345b";
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Developers of Mobile First apps for Android & Cordova using  *
  * JSONStore                                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Security scan of a MobileFirst app using the JSONStore SDK   *
  * detected a use of hard coded  password.This is seen only in  *
  * Android. For more details                                    *
  * https://cwe.mitre.org/data/definitions/259.html              *
  * Although this is a false positive since the password is not  *
  * used to protect any data, this string has been removed from  *
  * the code.                                                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * -                                                            *
  ****************************************************************
  

Problem conclusion

• Fixed the false positive report of a hard-coded password by
  removing the string from the code
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MOBILE1ST PF EN

• Fixed component ID

  5725I4300

Applicable component levels