« Volver al listado

CVE-2022-35734

Estado: ModificadaAlta (7.5)—

'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hjholdings — Hulu

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35734",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "HJ Holdings, Inc.",
          "product": "'Hulu / フールー' App for Android",
          "versions": [
            {
              "status": "affected",
              "version": "from version 3.0.47 to the version prior to 3.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-16T08:15:09.027",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN40907489/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN40907489/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app."
    },
    {
      "lang": "es",
      "value": "Hulu App para para Android desde versión 3.0.47 hasta versiones anteriores a 3.1.2, usa una clave API embebida para un servicio externo. Aprovechando esta vulnerabilidad, puede obtenerse la clave API de un servicio externo analizando los datos de la app."
    }
  ],
  "lastModified": "2026-06-17T04:52:09.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hjholdings:hulu:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FDEC545-A1A1-4D90-90B1-6CB352099C82",
              "versionEndExcluding": "3.1.2",
              "versionStartIncluding": "3.0.47"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}