Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-20835

Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jpcert

Description

Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity of the app via the vulnerable App, which may result in Mercari account's access token being obtained.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mercari, Inc. Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version)

  • versions prior to 4.49.1affected

References