CVE-2021-20748

Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view	Third Party Advisory
https://jvn.jp/en/jp/JVN26891339/index.html	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:retty:retty::::::android::*
	cpe:2.3:a:retty:retty::::::iphone_os::*

History

No history.

Information

Published : 2021-07-14 02:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-20748

Mitre link : CVE-2021-20748

CVE.ORG link : CVE-2021-20748

JSON object : View

Products Affected

retty

retty

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2021-20748", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-07-14T02:15:07.480", "references": [{"url": "https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN26891339/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."}, {"lang": "es", "value": "Retty App para Android versiones anteriores a 4.8.13 y Retty App para iOS versiones anteriores a la 4.11.14, usan una clave API codificada para un servicio externo. Al explotar esta vulnerabilidad, la clave API para un servicio externo puede ser obtenida al analizar datos en la app"}], "lastModified": "2021-07-16T14:17:08.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:retty:retty:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "201FA12D-05AD-447E-9A03-6FBBCB2E0E3D", "versionEndExcluding": "4.8.13"}, {"criteria": "cpe:2.3:a:retty:retty:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "24F84C67-92B3-4FCF-827A-F266ECC73331", "versionEndExcluding": "4.11.14"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}