Insecure Communication
Cleartext traffic, weak TLS, bypassable pinning, accept-all trust managers, and WebViews that ignore network security config.
5 vulnerabilities. OWASP Mobile: M5
| Vulnerability | ID | Platform | Difficulty | OWASP | MASVS | MASWE | MASTG (v2) | CWE |
|---|---|---|---|---|---|---|---|---|
| Cleartext Traffic Allowed | cleartext_traffic_allowed | AndroidiOS | EASY | M5 | MASVS-NETWORK-1 | MASWE-0026 | MASTG-TEST-0235MASTG-TEST-0237MASTG-TEST-0238MASTG-TEST-0322MASTG-TEST-0233 | CWE-319 |
| Accept-All TrustManager | accept_all_trust_manager | AndroidiOS | MEDIUM | M5 | MASVS-NETWORK-1MASVS-NETWORK-2 | MASWE-0027 | MASTG-TEST-0282MASTG-TEST-0283 | CWE-295 |
| Insecure WebView Networking | insecure_webview_networking | AndroidiOS | MEDIUM | M5 | MASVS-NETWORK-1MASVS-PLATFORM-2 | MASWE-0026 | MASTG-TEST-0237MASTG-TEST-0238MASTG-TEST-0235 | CWE-319CWE-295 |
| Weak / Outdated TLS Config | weak_tls_config | AndroidiOS | MEDIUM | M5 | MASVS-NETWORK-1 | MASWE-0026 | MASTG-TEST-0217MASTG-TEST-0218MASTG-TEST-0348 | CWE-326CWE-327 |
| SSL Pinning (Trivially Bypassable) | ssl_pinning_bypass | AndroidiOS | HARD | M5 | MASVS-NETWORK-2 | MASWE-0028 | MASTG-TEST-0244MASTG-TEST-0242 | CWE-295 |