CVE-2023-28387

"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497	Product
https://jvn.jp/en/jp/JVN32739265/	Third Party Advisory
https://play.google.com/store/apps/details?id=com.newspicks	Product
https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497	Product
https://jvn.jp/en/jp/JVN32739265/	Third Party Advisory
https://play.google.com/store/apps/details?id=com.newspicks	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:uzabase:newspicks::::::iphone_os::*
	cpe:2.3:a:uzabase:newspicks::::::android::*

History

21 Nov 2024, 07:54

Type	Values Removed	Values Added
References	() https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 - Product	() https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 - Product
References	~~() https://jvn.jp/en/jp/JVN32739265/ - Third Party Advisory~~	() https://jvn.jp/en/jp/JVN32739265/ - Third Party Advisory
References	~~() https://play.google.com/store/apps/details?id=com.newspicks - Product~~	() https://play.google.com/store/apps/details?id=com.newspicks - Product

07 Jul 2023, 18:24

Type	Values Removed	Values Added
First Time		Uzabase newspicks Uzabase
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~(MISC) https://jvn.jp/en/jp/JVN32739265/ -~~	(MISC) https://jvn.jp/en/jp/JVN32739265/ - Third Party Advisory
References	~~(MISC) https://play.google.com/store/apps/details?id=com.newspicks -~~	(MISC) https://play.google.com/store/apps/details?id=com.newspicks - Product
References	(MISC) https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 -	(MISC) https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 - Product
CPE		cpe:2.3:a:uzabase:newspicks::::::iphone_os::* cpe:2.3:a:uzabase:newspicks::::::android::*
CWE		CWE-798

30 Jun 2023, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-30 07:15

Updated : 2024-11-21 07:54

NVD link : CVE-2023-28387

Mitre link : CVE-2023-28387

CVE.ORG link : CVE-2023-28387

JSON object : View

Products Affected

uzabase

newspicks

CWE

CWE-798

Use of Hard-coded Credentials

5.5 /10