What is CVE-2021-20835?

CVE-2021-20835 is a high-severity vulnerability in Mercari, classified under Missing Authorization. CVSS score: 7.5/10. Published 2021-11-24.

How severe is CVE-2021-20835?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Mercari

CVE-2021-20835

Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity of the app via the vulnerable App, which may result in Mercari account's access token being obtained.

Vulnerability class: Broken Access Control

EPSS: 0.013 (68.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Mercari
Mercari, Inc. Android App 'Mercari (Merpay) - Marketplace And Mobile Payments App' (Japan Version) — versions versions prior to 4.49.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-20835?: CVE-2021-20835 is a high-severity vulnerability in Mercari, classified under Missing Authorization. CVSS score: 7.5/10. Published 2021-11-24.
How severe is CVE-2021-20835?: High severity. CVSS v3 base score is 7.5 out of 10.