PT-2023-22267 · Red Bull · Laola.Redbull

Published 2023-06-26 · Updated 2024-12-03 · CVE-2023-29459

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions laola.redbull application through 5.1.9-R for Android

Description The laola.redbull application exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary content into the context of the application. This can occur via the fcrbs schema or an explicit intent invocation.

Recommendations For versions through 5.1.9-R, consider disabling the at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity activity until a patch is available. Restrict access to the webview component to minimize the risk of exploitation. Avoid using the data: URI scheme in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-29459

Affected Products

Laola.Redbull

References · 6

• https://osv.dev/vulnerability/CVE-2023-29459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29459 · Security Note
• https://t.me/cibsecurity/65518 · Telegram Post
• http://packetstormsecurity.com/files/172701/FC-Red-Bull-Salzburg-App-5.1.9-R-Improper-Authorization.html · Note
• https://t.me/cvenotify/102935 · Telegram Post
• https://play.google.com/store/apps/details?id=laola.redbull · Note