CVE-2024-45203

Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

Score

CVSS 3.1 4.3 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2024-09-09

Last modified

2025-03-13

Weaknesses

CWE-939

Affected products

• @cosme (Istyle)
• Cosme App For Android (Istyle Inc.)
• Cosme App For Ios (Istyle Inc.)

References

• https://jvn.jp/en/jp/JVN81570776/