Lucene search

[email protected]CVE-2019-9140

HistoryAug 01, 2019 - 5:15 p.m.

CVE-2019-9140

2019-08-0117:15:13

CWE-601

CWE-94

[email protected]

web.nvd.nist.gov

cve-2019-9140

happypoint

mobile app

security

javascript

url redirection

information disclosure

nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn’t check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.

Affected configurations

NVD

Node

happypointcardhappypointMatch6.3.19android

CPENameOperatorVersion
happypointcard:happypointhappypointcard happypointeq6.3.19

CPE	Name	Operator	Version
happypointcard:happypoint	happypointcard happypoint	eq	6.3.19

CNA Affected

[
  {
    "platforms": [
      "Android"
    ],
    "product": "Happypoint mobile app",
    "vendor": "SPC CLOUD",
    "versions": [
      {
        "lessThanOrEqual": "6.3.19",
        "status": "affected",
        "version": "6.3.19",
        "versionType": "custom"
      }
    ]
  }
]

References

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

Related for CVE-2019-9140

cvelist1 prion1 nvd1