PT-2023-21688 · Unknown · Newspicks App

Sunagawa Masanori · Published 2023-06-30 · Updated 2023-07-07 · CVE-2023-28387

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NewsPicks App for Android versions 10.4.5 and earlier NewsPicks App for iOS versions 10.4.2 and earlier

Description The issue is related to hard-coded credentials in the NewsPicks App, which may allow a local attacker to analyze data in the app and obtain an API key for an external service.

Recommendations For NewsPicks App for Android versions 10.4.5 and earlier, update to a version later than 10.4.5 to resolve the issue. For NewsPicks App for iOS versions 10.4.2 and earlier, update to a version later than 10.4.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data within the app until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-28387

Affected Products

Newspicks App

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28387 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28387 · Vendor Advisory
• https://jvn.jp/en/jp/JVN32739265 · Note
• https://play.google.com/store/apps/details?id=com.newspicks · Note
• https://t.me/cvenotify/53369 · Telegram Post
• https://t.me/cibsecurity/65778 · Telegram Post
• https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497 · Note