JpcertCVE-2024-41918CVE-2024-41918
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
Low
EPSS
Percentile
21.3%
‘Rakuten Ichiba App’ for Android 12.4.0 and earlier and ‘Rakuten Ichiba App’ for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for custom URL scheme. An arbitrary site may be displayed on the WebView of the product via Intent from another application installed on the user’s device. As a result, the user may be redirected to an unauthorized site, and the user may become a victim of a phishing attack.
Affected configurations
CNA Affected
[
{
"vendor": "Rakuten Group, Inc.",
"product": "'Rakuten Ichiba App' for Android",
"versions": [
{
"version": "12.4.0 and earlier",
"status": "affected"
}
]
},
{
"vendor": "Rakuten Group, Inc.",
"product": "'Rakuten Ichiba App' for iOS",
"versions": [
{
"version": "11.7.0 and earlier",
"status": "affected"
}
]
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
Low
EPSS
Percentile
21.3%