Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Link | Tags |
---|---|
https://jvn.jp/en/jp/JVN77402327/index.html | not applicable |
https://www.tenable.com/cve/CVE-2020-5627 | third party advisory |