Published:2021/07/13  Last Updated:2023/03/08

Multiple vulnerabilities in Retty App


Retty App provided by Retty Inc. contains multiple vulnerabilities.

Products Affected

  • Retty App for Android versions prior to 4.8.13
  • Retty App for iOS versions prior to 4.11.14


Retty App provided by Retty Inc. contains multiple vulnerabilities listed below.

  • The app is launched by Custom URL Scheme and a user may be led to access an arbitrary URL (CWE-939) - CVE-2021-20747
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3
  • The App uses a hard-coded API key for external services (CWE-798) - CVE-2021-20748
    CVSS v3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score: 4.0
    CVSS v2 AV:N/AC:L/Au:N/C:P/I:N/A:N Base Score: 5.0


  • A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack - CVE-2021-20747
  • An attacker may analyze the data in the App and obtain the API key for external services - CVE-2021-20748
Note that the users are not directly affected by CVE-2021-20748 vulnerability.


Update the Application
Update the application to the latest version according to the information provided by the developer.

According to the developer, in the fixed version the vulnerable API key (CVE-2021-20748) is inactivated, therefore the information contained in the vulnerable App is no longer compromised.

Vendor Status


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC


Ryo Sato of BroadBand Security,Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2021-20747
JVN iPedia JVNDB-2021-000068

Update History

Information under the section [Credit] was updated.