CVE-2019-9140
Happypoint mobile application information disclosure vulnerability
- State
- Published
- Severity
- 7.8 High
- Published
- Aug 1, 2019
- Updated
- Sep 17, 2024
- Reserved
- Feb 25, 2019
Description
When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.8 High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | krcert |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
Happypoint mobile appSPC CLOUD |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.