Vulnerability Details CVE-2022-28799
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.026
EPSS Ranking 85.0%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr
- https://hackerone.com/reports/1500614
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities
- https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr
- https://hackerone.com/reports/1500614
- https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities