CVE-2019-8791
An issue existed in the parsing of URL schemes.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect.
Timeline
- CVE published
- Record last updated
Affected versions
- Apple Shazam-Android
fixed in Shazam Android App Version 9.25.0
- Apple Shazam-iOS
fixed in Shazam iOS App Version 12.11.0