CVE-2021-20873 Missing authorization in Yappli
Attackers can redirect users to unintended sites via crafted URLs due to improper authorization in the Custom URL Scheme handler of Yappli-based Android apps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-20873?
CVE-2021-20873 is a high-severity missing authorization vulnerability in Yappli, Inc. Yappli, published on 28 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL.
Weakness: CWE-862
Which versions are affected by CVE-2021-20873?
It affects 1 product.
Products include Yappli Yappli.
How do I fix CVE-2021-20873?
No fix has been published for CVE-2021-20873 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-20873 being exploited?
There is no known exploitation of CVE-2021-20873 in the wild and no public exploit code.
Sources
Also known as GHSA-qqj9-5rm5-5hhr.