« Volver al listado

CVE-2024-28895

Estado: AplazadaMedia (6.1)—

'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Yahoo — Japan APP AndroidAIYahoo — Japan APP IOSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28895",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28895",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-01T20:03:28.170849Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "LY Corporation",
          "product": "'Yahoo! JAPAN' App for Android",
          "versions": [
            {
              "status": "affected",
              "version": "v2.3.1 to v3.161.1"
            }
          ]
        },
        {
          "vendor": "LY Corporation",
          "product": "'Yahoo! JAPAN' App for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "v3.2.2 to v4.109.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-04-01T01:15:46.890",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN23528780/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN23528780/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's device."
    },
    {
      "lang": "es",
      "value": "Yahoo! JAPAN' App para Android v2.3.1 a v3.161.1 y 'Yahoo! La aplicación JAPAN para iOS v3.2.2 a v4.109.0 contiene una vulnerabilidad de cross-site scripting. Si se explota esta vulnerabilidad, se puede ejecutar un script arbitrario en WebView de Yahoo! JAPAN ' App a través de otra aplicación instalada en el dispositivo del usuario."
    }
  ],
  "lastModified": "2026-06-17T07:21:59.320",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}