PT-2023-21688 · Unknown · Newspicks App

Sunagawa Masanori · Publicado 2023-06-30 · Atualizado 2023-07-07 · CVE-2023-28387

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NewsPicks App for Android versions 10.4.5 and earlier NewsPicks App for iOS versions 10.4.2 and earlier

Description The issue is related to hard-coded credentials in the NewsPicks App, which may allow a local attacker to analyze data in the app and obtain an API key for an external service.

Recommendations For NewsPicks App for Android versions 10.4.5 and earlier, update to a version later than 10.4.5 to resolve the issue. For NewsPicks App for iOS versions 10.4.2 and earlier, update to a version later than 10.4.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data within the app until a patch is available.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-28387

Produtos afetados

Newspicks App

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28387 · Nota de Segurança
• https://jvn.jp/en/jp/JVN32739265 · Nota
• https://osv.dev/vulnerability/CVE-2023-28387 · Aviso do Fabricante
• https://play.google.com/store/apps/details?id=com.newspicks · Nota
• https://t.me/cvenotify/53369 · Publicação no Telegram
• https://t.me/cibsecurity/65778 · Publicação no Telegram
• https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 · Nota