CVE-2021-20873

Published: Dec 28, 2021Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL.

Affected (1)

Products: Yappli: Yappli

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Yappli Yappli	From 7.3.6 to 9.30.0

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://jvn.jp/en/jp/JVN66422035/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://support.yappli.co.jp/hc/ja/articles/4410249902745

Source: vultures@jpcert.or.jp

Vendor Advisory

https://jvn.jp/en/jp/JVN66422035/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.yappli.co.jp/hc/ja/articles/4410249902745

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.