|
[Japanese]
|
JVNDB-2021-000068
|
Multiple vulnerabilities in Retty App
|
|
Retty App provided by Retty Inc. contains multiple vulnerabilities listed below.
* The app is launched by Custom URL Scheme and a user may be led to access an arbitrary URL (CWE-939) - CVE-2021-20747
* The App uses a hard-coded API key for external services (CWE-798) - CVE-2021-20748
Ryo Sato of BroadBand Security,Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2021-20748
|
CVSS V3 Severity:
Base Metrics:
4.3 (Medium) [IPA Score]
-
Attack Vector: Network
-
Attack Complexity: Low
-
Privileges Required: None
-
User Interaction: Required
-
Scope: Unchanged
-
Confidentiality Impact: None
-
Integrity Impact: Low
-
Availability Impact: None
CVSS V2 Severity:Base Metrics:
4.3 (Medium)
[IPA Score]
-
Access Vector: Network
-
Access Complexity: Medium
-
Authentication: None
-
Confidentiality Impact: None
-
Integrity Impact: Partial
-
Availability Impact: None
The above CVSS base scores have been assigned for CVE-2021-20747
|
|
|
Retty, INC.
- Retty App for Android versions prior to 4.8.13
- Retty App for iOS versions prior to 4.11.14
|
|
|
The expected impact depends on each vulnerability, but it may be affected as follows.
* A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack - CVE-2021-20747
* An attacker may analyze the data in the App and obtain the API key for external services - CVE-2021-20748
Note that the users are not directly affected by CVE-2021-20748 vulnerability.
|
|
[Update the Application]
Update the application to the latest version according to the information provided by the developer.
According to the developer, in the fixed version the vulnerable API key (CVE-2021-20748) is inactivated, therefore the information contained in the vulnerable App is no longer compromised.
|
|
Retty, INC.
|
|
- Permissions(CWE-264) [IPA Evaluation]
- No Mapping(CWE-Other) [IPA Evaluation]
|
|
- CVE-2021-20747
- CVE-2021-20748
|
|
- JVN : JVN#26891339
|
|
- [2021/07/13]
Web page was published
- [2023/03/08]
Overview was modified
|
