QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-20835

Back to search

CVE-2021-20835

Published: Nov 24, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity of the app via the vulnerable App, which may result in Mercari account's access token being obtained.

VendorProductVersions

Mercari, Inc.

Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version)

affected
versions prior to 4.49.1

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now