CVE-2019-16681 Information

Description

The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity leading to the opening of arbitrary URLs which can inject deceptive content into the UI. (When in physical possession of the device opening local files is also possible.) NOTE: As of 2019-09-23 the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege Sensitive Data Leakage or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability https://web.archive.org/web/20190923165849/https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

4.7