CNN App Leaks Passwords Of Citizen Reporters

zScaler discovered that CNN’s iPhone app (v2.30) transmitted user passwords and registration/login traffic in clear text (HTTP), allowing an attacker on the same network to sniff credentials and potentially take over iReport accounts; the Android app used SSL and pinning and CNN reportedly updated the iPhone app for submission to Apple.