Skip to main content

Improper Authorization in Handler for Custom URL Scheme

CVE-2024-35298

Medium
4.3/10

Summary

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing attack.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • NONE

CWE-939 - Improper Authorization in Handler for Custom URL Scheme

The software uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

References

Advisory Timeline

  • Published