JVN#31864411
Multiple access restriction bypass vulnerabilities in UNIQLO App

Overview

UNIQLO App contains multiple access restriction bypass vulnerabilities.

Products Affected

• UNIQLO App for Android versions 7.3.3 and earlier

Description

UNIQLO App provided by UNIQLO CO., LTD. contains multiple access restriction bypass vulnerabilities below.
A remote attacker may be able to lead a user to access an arbitrary website via the vulnerable App.

• The App launched by a Custom URL Scheme may lead a user to access an arbitrary URL - CVE-2020-5628

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

• The App may receive an Intent from an arbitrary App which may lead a user to access an arbitrary URL requested by an Intent - CVE-2020-5629

  CVSS v3	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 3.3
  CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Impact

A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.
The vulnerability is fixed in version 7.3.4.