Vulnerability · Published Mar 18, 2024 · Assigned by jpcert

CVE-2024-28745

Low 3.3

In plain English

A low-severity incorrect permission assignment in 'ABEMA' App for Android from AbemaTV, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 92.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.

Affected products (as reported)

Vendor	Product	Versions
AbemaTV, Inc.	'ABEMA' App for Android	prior to 10.65.0

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://jvn.jp/en/jp/JVN70640802/