Vulnerability · Published Jun 17, 2024 · Assigned by jpcert
CVE-2024-36279
Medium 5.3
In plain English
A medium-severity security flaw in "FreeFrom - the nostr client" App for Android from FreeFrom K.K.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FreeFrom K.K. | "FreeFrom - the nostr client" App for Android | prior to 1.3.5 |
| FreeFrom K.K. | "FreeFrom - the nostr client" App for iOS | prior to 1.3.5 |
Weakness: CWE-649 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N