CVE-2024-45203

Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN81570776/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:istyle:\@cosme::::::android::*
	cpe:2.3:a:istyle:\@cosme::::::iphone_os::*

History

16 Sep 2024, 13:27

Type	Values Removed	Values Added
References	~~() https://jvn.jp/en/jp/JVN81570776/ -~~	() https://jvn.jp/en/jp/JVN81570776/ - Third Party Advisory
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
First Time		Istyle \@cosme Istyle
CPE		cpe:2.3:a:istyle:\@cosme::::::android::* cpe:2.3:a:istyle:\@cosme::::::iphone_os::*

09 Sep 2024, 13:03

Type	Values Removed	Values Added
Summary		(es) La autorización incorrecta en el controlador para el problema del esquema de URL personalizado en la aplicación "@cosme" para versiones de Android anteriores a la 5.69.0 y la aplicación "@cosme" para versiones de iOS anteriores a la 6.74.0 permite que un atacante haga que un usuario acceda a un sitio web arbitrario a través de la aplicación vulnerable. Como resultado, el usuario puede convertirse en víctima de un ataque de phishing.

09 Sep 2024, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-09 07:15

Updated : 2024-09-16 13:27

NVD link : CVE-2024-45203

Mitre link : CVE-2024-45203

CVE.ORG link : CVE-2024-45203

JSON object : View

Products Affected

istyle

\@cosme

CWE

NVD-CWE-noinfo

4.3 /10