Vulnerability · Published Jun 17, 2024 · Assigned by jpcert
CVE-2024-36277
Medium 5.3
In plain English
A medium-severity security flaw in "FreeFrom - the nostr client" App for Android from FreeFrom K.K.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 82.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FreeFrom K.K. | "FreeFrom - the nostr client" App for Android | prior to 1.3.5 |
| FreeFrom K.K. | "FreeFrom - the nostr client" App for iOS | prior to 1.3.5 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N