JVN#26891339: Multiple vulnerabilities in Retty App

Retty App provided by Retty Inc. contains multiple vulnerabilities listed below.

The app is launched by Custom URL Scheme and a user may be led to access an arbitrary URL (CWE-939) - CVE-2021-20747

The App uses a hard-coded API key for external services (CWE-798) - CVE-2021-20748

Impact

• A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack - CVE-2021-20747
• An attacker may analyze the data in the App and obtain the API key for external services - CVE-2021-20748
  Note that the users are not directly affected by CVE-2021-20748 vulnerability.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

According to the developer, in the fixed version the vulnerable API key (CVE-2021-20748) is inactivated, therefore the information contained in the vulnerable App is no longer compromised.

Products Affected

• Retty App for Android versions prior to 4.8.13
• Retty App for iOS versions prior to 4.11.14