PT-2024-28026 · Unknown · Piccoma App

Yoshihito Sakai · Published 2024-07-01 · Updated 2024-11-12 · CVE-2024-38480

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piccoma App versions prior to 6.20.0

Description The issue concerns the use of a hard-coded API key for an external service in the Piccoma App, which could potentially allow a local attacker to obtain the API key. It is noted that the users of the app are not directly affected by this issue.

Recommendations For versions prior to 6.20.0, update to version 6.20.0 or later to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-38480

Affected Products

Piccoma App

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-38480 · Security Note
• https://play.google.com/store/apps/details?id=jp.kakao.piccoma · Note
• https://jvn.jp/en/jp/JVN01073312 · Note
• https://t.me/cvenotify/101426 · Telegram Post
• https://apps.apple.com/jp/app/%E3%83%94%E3%83%83%E3%82%B3%E3%83%9E/id1091496983 · Note