PT-2024-16303 · Unknown · Focus For Ios

James Lee · CVE-2024-10474 · Published 2024-10-29 · Updated 2024-11-04

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 132

Description The issue allows internal links to utilize the app scheme used for deeplinking, potentially circumventing some URL safety checks. This could result in link spoofing.

Recommendations For Focus for iOS versions prior to 132, update to version 132 or later to resolve the issue. As a temporary workaround, consider restricting internal links from utilizing the app scheme used for deeplinking until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-10474

Affected Products

Focus For Ios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-10474 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10474 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-60 · Vendor Advisory
• https://twitter.com/UndercodeNews/status/1853460891154502111 · Twitter Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=1863832 · Note