What is CVE-2024-28745?

CVE-2024-28745 is a low-severity vulnerability in Abematv, Inc. 'Abema' App For Android, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 3.3/10. Published 2024-03-18.

How severe is CVE-2024-28745?

Low severity. CVSS v3 base score is 3.3 out of 10.

Is CVE-2024-28745 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Abematv, Inc. 'Abema' App For Android

CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.

EPSS: 0.002 (7.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Abematv, Inc. 'Abema' App For Android — versions prior to 10.65.0

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

Public proof-of-concept exploits

References

vultures@jpcert.or.jp

Frequently asked questions

What is CVE-2024-28745?: CVE-2024-28745 is a low-severity vulnerability in Abematv, Inc. 'Abema' App For Android, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 3.3/10. Published 2024-03-18.
How severe is CVE-2024-28745?: Low severity. CVSS v3 base score is 3.3 out of 10.
Is CVE-2024-28745 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.