CVE-2022-28799
high · 8.8The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click.
8.8
CVSS
16.0%
EPSS (exploit prob.)
97th
EPSS percentile
2022-06-02
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-425
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| tiktok | tiktok | < 23.7.3 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr
- https://hackerone.com/reports/1500614
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr
- https://hackerone.com/reports/1500614
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-28799