← Back

CVE-2024-45203

nvd nist
Published: Sep 9, 2024Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

Affected (2)

Products: Istyle: @cosme
Istyle
1 product
@cosme
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Istyle
@cosme
Before 5.69.0
@cosme
Up to 6.74.0

Related CWEs

CWE-939
Improper Authorization in Handler for Custom URL Scheme
The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References (1)

Source: vultures@jpcert.or.jp
Third Party Advisory

Timeline

No history available yet.