CVE-2023-28387

🗓️ 30 Jun 2023 06:22:37Reported by jpcertType

"NewsPicks" App for Android/iOS uses hard-coded credentials, allowing local attacker to access API key for external service

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-28387	30 Jun 202312:15	–	circl
CNNVD	NewsPicks 信任管理问题漏洞	30 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-28387	30 Jun 202306:22	–	cvelist
EUVD	EUVD-2023-32083	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	JVN#32739265: "NewsPicks" App uses a hard-coded API key for an external service	30 Jun 202300:00	–	jvn
Japan Vulnerability Notes	"NewsPicks" App uses a hard-coded API key for an external service	30 Jun 202306:06	–	jvn
NVD	CVE-2023-28387	30 Jun 202307:15	–	nvd
OSV	CVE-2023-28387	30 Jun 202307:15	–	osv
Prion	Hardcoded credentials	30 Jun 202307:15	–	prion
Positive Technologies	PT-2023-21688 · Unknown · Newspicks App	30 Jun 202300:00	–	ptsecurity

NVD

Vulners

Node

uzabase newspicksRange≤10.4.2iphone_os

uzabase newspicksRange≤10.4.5android

[
  {
    "vendor": "NewsPicks, Inc.",
    "product": "\"NewsPicks\" App for Android",
    "versions": [
      {
        "version": "versions 10.4.5 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "NewsPicks, Inc.",
    "product": "\"NewsPicks\" App for iOS",
    "versions": [
      {
        "version": "versions 10.4.2 and earlier",
        "status": "affected"
      }
    ]
  }
]

Source	Link
apps	www.apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497
jvn	www.jvn.jp/en/jp/JVN32739265/
play	www.play.google.com/store/apps/details

21 Nov 2024 07:54Current

5Medium risk

Vulners AI Score5

CVSS 3.15.5

EPSS0.00036

SSVC

CWE-798