« Volver al listado

CVE-2024-54014

Estado: AplazadaBaja (3.6)—

Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Skylark — Skylark APPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-54014",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-54014",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-05T11:33:12.969638Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 3.6,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "SKYLARK HOLDINGS CO., LTD.",
          "product": "'Skylark' App for Android",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.13 and earlier"
            }
          ]
        },
        {
          "vendor": "SKYLARK HOLDINGS CO., LTD.",
          "product": "'Skylark' App for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.13 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-05T03:15:14.530",
  "references": [
    {
      "url": "https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN03447226/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-939"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device."
    },
    {
      "lang": "es",
      "value": "La autorización incorrecta en el controlador para el problema del esquema de URL personalizado en la aplicación 'Skylark' para Android 6.2.13 y versiones anteriores y la aplicación 'Skylark' para iOS 6.2.13 y versiones anteriores permite que un atacante haga que la aplicación acceda a un sitio web arbitrario a través de otra aplicación instalada en el dispositivo del usuario."
    }
  ],
  "lastModified": "2026-06-17T08:09:40.307",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}