CVE-2022-41797 Open redirect in Lemon8 App for Android and Lemon8 App for iOS
A remote attacker can redirect users to arbitrary websites via a custom URL scheme, facilitating phishing attacks in the Lemon8 mobile app.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41797?
CVE-2022-41797 is a medium-severity vulnerability in ByteDance K.K. Lemon8 App for Android and Lemon8 App for iOS, published on 24 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Weakness: CWE-862
Which versions are affected by CVE-2022-41797?
It affects 1 product.
Products include Lemon8 Project Lemon8.
How do I fix CVE-2022-41797?
No fix has been published for CVE-2022-41797 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41797 being exploited?
There is no known exploitation of CVE-2022-41797 in the wild and no public exploit code.
Sources
Also known as GHSA-9phr-845q-6wwg.