PT-2024-22554 · Unknown · Abema App For Android

Shiga Takuma · CVE-2024-28745 · Published 2024-03-17 · Updated 2024-11-19

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ABEMA App for Android versions prior to 10.65.0

Description The issue exists due to the improper export of Android application components, allowing another app installed on the user's device to access an arbitrary URL on the ABEMA App for Android via Intent. If exploited, an arbitrary website may be displayed on the app, potentially leading to phishing attacks.

Recommendations For versions prior to 10.65.0, update to version 10.65.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of Intents to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-28745

Affected Products

Abema App For Android

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-28745 · Security Note
• https://twitter.com/CVEnew/status/1769568888356798605 · Twitter Post
• https://jvn.jp/en/jp/JVN70640802 · Note
• https://t.me/cvenotify/74120 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1769599900537270678 · Twitter Post
• https://twitter.com/RedPacketSec/status/1770028597425615018 · Twitter Post