PT-2021-14278 · Nike · Nike App For Ios+1

Published 2021-10-13 · Updated 2022-05-03 · CVE-2021-20834

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nike App for Android versions prior to 2.177 Nike App for iOS versions prior to 2.177.1

Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to trick a user into accessing an arbitrary website via the vulnerable App.

Recommendations: For Nike App for Android versions prior to 2.177, update to version 2.177 or later. For Nike App for iOS versions prior to 2.177.1, update to version 2.177.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-20834

Affected Products

Nike App For Android

Nike App For Ios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-20834 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20834 · Vendor Advisory
• https://apps.apple.com/app/nike/id1095459556 · Note
• https://play.google.com/store/apps/details?id=com.nike.omega · Note
• https://jvn.jp/en/jp/JVN89126639/index.html · Note