Vulnerability · Published Dec 28, 2021 · Assigned by jpcert
CVE-2021-20873
High 8.1
In plain English
A high-severity security flaw in Yappli from Yappli, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.9%top 41.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Yappli, Inc. | Yappli | versions since v7.3.6 and prior to v9.30.0 |
References
- https://support.yappli.co.jp/hc/ja/articles/4410249902745 x_refsource_MISC
- https://jvn.jp/en/jp/JVN66422035/index.html x_refsource_MISC