PT-2021-14279 · Mercari · Mercari

Ryotak · Published 2021-11-24 · Updated 2022-05-03 · CVE-2021-20835

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mercari (Merpay) - Marketplace and Mobile Payments App versions prior to 4.49.1

Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website. This website can then launch an arbitrary Activity of the app via the vulnerable App, potentially resulting in the Mercari account's access token being obtained.

Recommendations: For versions prior to 4.49.1, update to version 4.49.1 or later to resolve the issue. As a temporary workaround, consider restricting access to custom URL schemes within the app to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-20835

Affected Products

Mercari

References · 5

• https://osv.dev/vulnerability/CVE-2021-20835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20835 · Security Note
• https://t.me/cvenotify/23917 · Telegram Post
• https://jvn.jp/en/jp/JVN49465877/index.html · Note
• https://t.me/cibsecurity/32954 · Telegram Post