CVE-2023-28387

Published: Jun 30, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service.

Affected (2)

Products: Uzabase: Newspicks

Uzabase

1 product

Newspicks

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Uzabase Newspicks	Up to 10.4.5
Uzabase Newspicks	Up to 10.4.2

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

https://apps.apple.com/us/app/%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%BA%E3%83%94%E3%83%83%E3%82%AF%E3%82%B9-%E3%83%93%E3%82%B8%E3%83%8D%E3%82%B9%E3%81%AB%E5%BD%B9%E7%AB%8B%E3%81%A4%E7%B5%8C%E6%B8%88%E3%83%8B%E3%83%A5%E3%83%BC%E3%82%B9%E3%82%A2%E3%83%97%E3%83%AA/id640956497

Source: vultures@jpcert.or.jp

Product

https://jvn.jp/en/jp/JVN32739265/

Source: vultures@jpcert.or.jp

Third Party Advisory

https://play.google.com/store/apps/details?id=com.newspicks

Source: vultures@jpcert.or.jp

Product

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://jvn.jp/en/jp/JVN32739265/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://play.google.com/store/apps/details?id=com.newspicks

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.