CVE-2019-8791 Open redirect in Shazam-Android
Attackers can exploit URL parsing flaws in the Shazam mobile app to redirect users to malicious sites, requiring an app update to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-8791?
CVE-2019-8791 is a medium-severity vulnerability in Apple Shazam-Android, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect.
Weakness: CWE-601
Which versions are affected by CVE-2019-8791?
It affects 1 product.
Products include Apple Shazam.
How do I fix CVE-2019-8791?
No fix has been published for CVE-2019-8791 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-8791 being exploited?
There is no known exploitation of CVE-2019-8791 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apple Shazam-Android
Sources
Also known as GHSA-g2ww-4cqg-3582.