CVE-2024-54014

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-54014", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-11-27T08:11:25.031Z", "datePublished": "2024-12-05T02:42:14.019Z", "dateUpdated": "2024-12-05T11:33:27.693Z"}, "containers": {"cna": {"affected": [{"vendor": "SKYLARK HOLDINGS CO., LTD.", "product": "'Skylark' App for Android", "versions": [{"version": "6.2.13 and earlier", "status": "affected"}]}, {"vendor": "SKYLARK HOLDINGS CO., LTD.", "product": "'Skylark' App for iOS", "versions": [{"version": "6.2.13 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device."}], "problemTypes": [{"descriptions": [{"description": "Improper authorization in handler for custom URL scheme", "lang": "en-US", "cweId": "CWE-939", "type": "CWE"}]}], "references": [{"url": "https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto"}, {"url": "https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478"}, {"url": "https://jvn.jp/en/jp/JVN03447226/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "LOW", "baseScore": 3.6, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-12-05T02:42:14.019Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-54014", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T11:33:12.969638Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T11:33:27.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-54014", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T11:33:12.969638Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T11:33:15.432Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "SKYLARK HOLDINGS CO., LTD.", "product": "'Skylark' App for Android", "versions": [{"status": "affected", "version": "6.2.13 and earlier"}]}, {"vendor": "SKYLARK HOLDINGS CO., LTD.", "product": "'Skylark' App for iOS", "versions": [{"status": "affected", "version": "6.2.13 and earlier"}]}], "references": [{"url": "https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto"}, {"url": "https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478"}, {"url": "https://jvn.jp/en/jp/JVN03447226/"}], "descriptions": [{"lang": "en", "value": "Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-939", "description": "Improper authorization in handler for custom URL scheme"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-12-05T02:42:14.019Z"}}}, "cveMetadata": {"cveId": "CVE-2024-54014", "state": "PUBLISHED", "dateUpdated": "2024-12-05T11:33:27.693Z", "dateReserved": "2024-11-27T08:11:25.031Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-12-05T02:42:14.019Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "'Skylark' App for Android", "vendor": "SKYLARK HOLDINGS CO., LTD.", "versions": [{"status": "affected", "version": "6.2.13 and earlier"}]}, {"product": "'Skylark' App for iOS", "vendor": "SKYLARK HOLDINGS CO., LTD.", "versions": [{"status": "affected", "version": "6.2.13 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device."}, {"lang": "es", "value": "La autorizaci\u00f3n incorrecta en el controlador para el problema del esquema de URL personalizado en la aplicaci\u00f3n 'Skylark' para Android 6.2.13 y versiones anteriores y la aplicaci\u00f3n 'Skylark' para iOS 6.2.13 y versiones anteriores permite que un atacante haga que la aplicaci\u00f3n acceda a un sitio web arbitrario a trav\u00e9s de otra aplicaci\u00f3n instalada en el dispositivo del usuario."}], "id": "CVE-2024-54014", "lastModified": "2026-06-17T08:09:40.307", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-54014", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-05T11:33:12.969638Z", "version": "2.0.3"}}]}, "published": "2024-12-05T03:15:14.530", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN03447226/"}, {"source": "vultures@jpcert.or.jp", "url": "https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-939"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{}