JVN#26891339
Multiple vulnerabilities in Retty App

Overview

Retty App provided by Retty Inc. contains multiple vulnerabilities.

Products Affected

• Retty App for Android versions prior to 4.8.13
• Retty App for iOS versions prior to 4.11.14

Description

Retty App provided by Retty Inc. contains multiple vulnerabilities listed below.

• The app is launched by Custom URL Scheme and a user may be led to access an arbitrary URL (CWE-939) - CVE-2021-20747

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

• The App uses a hard-coded API key for external services (CWE-798) - CVE-2021-20748

  CVSS v3	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Base Score: 4.0
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

Impact

• A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack - CVE-2021-20747
• An attacker may analyze the data in the App and obtain the API key for external services - CVE-2021-20748

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

According to the developer, in the fixed version the vulnerable API key (CVE-2021-20748) is inactivated, therefore the information contained in the vulnerable App is no longer compromised.