CVE-2023-28387

2023-06-3006:22:37

jpcert

www.cve.org

newspicks

hard-coded credentials

vulnerability

android

ios

api key

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

“NewsPicks” App for Android versions 10.4.5 and earlier and “NewsPicks” App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service.

CNA Affected

[
  {
    "vendor": "NewsPicks, Inc.",
    "product": "\"NewsPicks\" App for Android",
    "versions": [
      {
        "version": "versions 10.4.5 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "NewsPicks, Inc.",
    "product": "\"NewsPicks\" App for iOS",
    "versions": [
      {
        "version": "versions 10.4.2 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497

jvn.jp/en/jp/JVN32739265/

play.google.com/store/apps/details?id=com.newspicks