CVE-2022-28799

State: Published
Severity: Not scored
Published: May 30, 2022
Updated: Aug 3, 2024
Reserved: Apr 8, 2022

Description

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities
https://hackerone.com/reports/1500614
https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.