CVE-2024-36279

2024-06-1707:34:09

jpcert

github.com

freefrom

nostr client

android

ios

manipulation

direct messages

security issue

encryption

integrity checking

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in “FreeFrom - the nostr client” App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:*"
    ],
    "vendor": "freefrom_kk",
    "product": "freefrom_the_nostr_client_app",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.3.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]