CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN70640802/
https://jvn.jp/en/jp/JVN70640802/

Configurations

No configuration.

History

21 Nov 2024, 09:06

Type	Values Removed	Values Added
References	~~() https://jvn.jp/en/jp/JVN70640802/ -~~	() https://jvn.jp/en/jp/JVN70640802/ -

19 Nov 2024, 20:35

Type	Values Removed	Values Added
CWE		CWE-732
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.3

18 Mar 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-18 04:15

Updated : 2024-11-21 09:06

NVD link : CVE-2024-28745

Mitre link : CVE-2024-28745

CVE.ORG link : CVE-2024-28745

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2024-28745", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2024-03-18T04:15:09.987", "references": [{"url": "https://jvn.jp/en/jp/JVN70640802/", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN70640802/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack."}, {"lang": "es", "value": "Existe un problema de exportaci\u00f3n incorrecta de los componentes de la aplicaci\u00f3n de Android en la aplicaci\u00f3n 'ABEMA' para Android anterior a 10.65.0, lo que permite que otra aplicaci\u00f3n instalada en el dispositivo del usuario acceda a una URL arbitraria en la aplicaci\u00f3n 'ABEMA' para Android a trav\u00e9s de Intent. Si se explota esta vulnerabilidad, es posible que se muestre un sitio web arbitrario en la aplicaci\u00f3n y, como resultado, el usuario puede convertirse en v\u00edctima de un ataque de phishing."}], "lastModified": "2024-11-21T09:06:52.440", "sourceIdentifier": "vultures@jpcert.or.jp"}

3.3 /10