What is CVE-2019-9140?

CVE-2019-9140 is a high-severity vulnerability in Happypointcard Happypoint, classified under Code Injection. CVSS score: 8.1/10. Published 2019-08-01.

How severe is CVE-2019-9140?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Happypointcard Happypoint

CVE-2019-9140

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

Affected products

Happypointcard Happypoint — versions 6.3.19
Spc Cloud Happypoint Mobile App — versions 6.3.19

Weakness classification (CWE)

References

vuln@krcert.or.kr (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2019-9140?: CVE-2019-9140 is a high-severity vulnerability in Happypointcard Happypoint, classified under Code Injection. CVSS score: 8.1/10. Published 2019-08-01.
How severe is CVE-2019-9140?: High severity. CVSS v3 base score is 8.1 out of 10.