CVE-2024-23388

MEDIUM

Mercari < 5.78.0 - Missing Authorization in Custom URL Scheme Handler

Title source: llm
STIX 2.1

Description

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

References (1)

Core 1
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN70818619/

Scores

CVSS v3 6.1
EPSS 0.0039
EPSS Percentile 30.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
mercari/mercari < 5.78.0
Published Jan 26, 2024
Tracked Since Feb 18, 2026