JVNDB-2021-000096

Android App "Mercari (Merpay) - Marketplace and Mobile Payments App" (Japan version) vulnerable to improper handling of Intent

Android App "Mercari (Merpay) - Marketplace and Mobile Payments App" (Japan version) provided by Mercari, Inc. is vulnerable to improper handling of Intent (CWE-939).

RyotaK reported this vulnerability to Mercari, Inc. and Mercari, Inc. reported it to JPCERT/CC to disclose the vulnerability through JVN.

Mercari Co., Ltd.

• Mercari Android App (Japan version) versions prior to 4.49.1

The developer states that affected versions are no longer used at this point because the update was applied automatically when the application was launched in the past.

If a user who is using the vulnerable application accesses a malicious page, the malicious page can launch an arbitrary Activity of the application. As a result, Mercari account's access token may be obtained.

[Update the application]
Update the application to the latest version according to the information provided by the developer.
The developer states there is no need for users to take any actions since the application is automatically updated when it is launched.

Mercari Co., Ltd.

• JVN : Information from Mercari, Inc.

1. Permissions(CWE-264) [IPA Evaluation]

1. CVE-2021-20835

1. JVN : JVN#49465877
2. National Vulnerability Database (NVD) : CVE-2021-20835

• [2021/10/29]
    Web page was published