CVE-2024-38480

2024-07-0102:27:01

jpcert

www.cve.org

piccoma

android

ios

api key

external service

0.0004 Low

EPSS

Percentile

15.7%

JSON

“Piccoma” App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.

CNA Affected

[
  {
    "vendor": "Kakao piccoma Corp.",
    "product": "\"Piccoma\" App for Android",
    "versions": [
      {
        "version": "prior to 6.20.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Kakao piccoma Corp.",
    "product": "\"Piccoma\" App for iOS",
    "versions": [
      {
        "version": "prior to 6.20.0",
        "status": "affected"
      }
    ]
  }
]